Security Advisory SA40492 - Sijio Multiple Script Insertion Vulnerabilities

Secunia

Blog

Secunia Advisory SA40492

Sijio Multiple Script Insertion Vulnerabilities

Secunia Advisory

SA40492

Release Date

2010-07-08

Last Update

2010-07-14

Popularity

2,319 views

Comments

1 comment

Criticality level

Moderately critical

Impact

Cross Site Scripting

Where

From remote

Authentication level

This information is available to Secunia VIM customers

Report reliability

This information is available to Secunia VIM customers

Solution Status

Unpatched

Systems affected

This information is available to Secunia VIM customers

Approve distribution

This information is available to Secunia VIM customers

Remediation status

Secunia VIM

Software:

Sijio 1.x

Secunia CVSS Score

This information is available to Secunia VIM Customers

CVE Reference(s)

CVE-2010-2697 CVSS score available to Secunia VIM customers
CVE-2010-2698 CVSS score available to Secunia VIM customers

Description

Multiple vulnerabilities have been reported in Sijio, which can be exploited by malicious users to conduct script insertion attacks.

Input passed via the "title" POST parameter while adding or editing a blog and while adding or editing an album is not properly sanitised before being displayed to the user. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed.

Solution
Edit the source code to ensure that input is properly sanitised.

Provided and/or discovered by
Sid3^effects and an anonymous person.

Changelog
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers

Do you have additional information related to this advisory?

Please provide information about patches, mitigating factors, new versions, exploits, faulty patches, links, and other relevant data by posting comments to this Advisory. You can also send this information to vuln@secunia.com

Subject: Sijio Multiple Script Insertion Vulnerabilities

User

Message

roy_keane

RE: Sijio Multiple Script Insertion Vulnerabilities

4th Oct, 2010 11:31

Score: 0
Posts: 1
User Since: 4th Oct 2010
System Score: N/A
Location: IE
Last edited on 4th Oct, 2010 11:32

Yes, it is reproduced on the Sijio demo website!!!
E.g. http://www.axlex.com/edit_blog/?id=2&title=Initial Title<SCRIPT>alert('hack');</SCRIPT>.
To check it authorize first.
But after saving the blog, it will disappear.

I guess there is no problem at all if only a hacker suffers from his trick. I think the issue cannot be called 'a bug'.

Was this reply relevant?

-0

Secunia Advisory SA40492

Sijio Multiple Script Insertion Vulnerabilities

Do you have additional information related to this advisory?

You must be logged in to post a comment.

Secunia Customer Login

Not a customer already?