Detections
Analytics
pLog register.php Multiple Parameter XSS
medium Nessus Plugin ID 16207
Language:
Synopsis
A remote CGI is vulnerable to cross-site scripting.Description
The remote host is running pLog, a blogging system written in PHP.The remote version of this software does not perform a proper validation of user-supplied input and is, therefore, vulnerable to a cross-site scripting attack.
To exploit this flaw, an attacker would need to use the script 'register.php' to register a user profile containing HTML and script code as the attacker's name or blog.
Regular users of the remote website would then display the HTML and/or script code in their browser when visiting the page 'summary.php'.
Solution
Upgrade to pLog 0.3.3 or newer.Plugin Details
Severity: Medium
ID: 16207
File Name: plog_html_injection.nasl
Version: 1.19
Type: remote
Family: CGI abuses : XSS
Published: 1/19/2005
Updated: 1/19/2021
Supported Sensors: Nessus
Vulnerability Information
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Available: true
Exploit Ease: No exploit is required
Vulnerability Publication Date: 8/31/2004
Reference Information
BID: 11082