Secunia

Multiple vulnerabilities have been reported in Geeklog allowing malicious people to conduct Cross Site Scripting and retrieve password hashes.

Geeklog stores the password hash in cookies to verify if users are logged in. This could expose the password if Cross Site Scripting vulnerabilities exist.

Logged in users do not need to supply the old password to change it. This is not regarded as a vulnerability, but it is an inappropriate way to handle password changes.

While most functions in the forum do filter out normal "<SCRIPT>" tags, it is still possible to inject script using HTML parameters.

Example:
<img src="javascript:alert()">

Solution
Edit the source code so that input is properly validated or use a different product.

Provided and/or discovered by
jelmer

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area