Simple PHP Blog / Bugs / #270 CVE-2007-5072: Multiple cross-site scripting (XSS) vulnerabi

#270 CVE-2007-5072: Multiple cross-site scripting (XSS) vulnerabi

Status: closed-fixed

Owner: nabber00

Labels: Security (24)

Priority: 4

Updated: 2011-12-13

Created: 2011-12-13

Creator: nabber00

Private: No

Multiple cross-site scripting (XSS) vulnerabilities in Simple PHP Blog (SPHPBlog) before 0.5.1, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via certain user_colors array parameters to certain user_style.php files under themes/, as demonstrated by the user_colors[bg_color] parameter.

Discussion

nabber00 - 2011-12-13

This was fixed in 0.5.1.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

nabber00 - 2011-12-13

status: open --> closed-fixed
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

CVE-2007-5072: Multiple cross-site scripting (XSS) vulnerabi

Group

Searches

Help

#270 CVE-2007-5072: Multiple cross-site scripting (XSS) vulnerabi

Discussion