Archangel Weblog 0.90.02 and prior Multiple HTML injections

2006.08.11

Credit: HeLiOsZ - Dark End Team

Risk: Medium

Local: No

Remote: Yes

CVE: CVE-2006-4091

CWE: CWE-Other

CVSS Base Score: 4.3/10

Impact Subscore: 2.9/10

Exploitability Subscore: 8.6/10

Exploit range: Remote

Attack complexity: Medium

Authentication: No required

Confidentiality impact: None

Integrity impact: Partial

Availability impact: None

## HeLiOsZ - Dark End Team - Internet Security Team
## Archangel Weblog 0.90.02 and prior Multiple HTML injections
## IRC: darkend.sytes.net #darkend , http://darkend.sytes.net &
http://www.darkend.org
## Rish : Medium
## Type : web applet
## Creator: http://www.archangelmgt.com/
## Exploit:
- To exploit this issue you must only put your injection in the Name,or the
Comment
section,because that two parts do not sanitize the imput
_________________________________________________________________
Express yourself instantly with MSN Messenger! Download today it's FREE!
http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

See this note in RAW Version

Vote for this issue:

100%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Archangel Weblog 0.90.02 and prior Multiple HTML injections

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.