Typo <= 5.1.3 Multiple Vulnerabilities

2008.11.02
Credit: L4teral
Risk: Medium
Local: No
Remote: Yes

====================================================================== Typo <= 5.1.3 Multiple Vulnerabilities ====================================================================== Author: L4teral <l4teral [at] gmail com> Impact: Cross Site Scripting SQL Injection Insecure password hash salt Status: patch not available ------------------------------ Affected software description: ------------------------------ Application: Typo Version: <= 5.1.3 Vendor: http://typosphere.org Description: Typo is a blogging engine developped with the Ruby on Rails framework. -------------- Vulnerability: -------------- 1. The feedback system is vulnerable to cross site scripting. Script code can be embedded into the "Name" and "Website" fields when posting a new comment. If the comments are viewed in the admin panel, the code gets executed in the context of the admin user. The code embedded in the website paramter also gets executed when viewing the blog post as normal user. 2. The "Manage pages" part of the administration panel is prone to SQL injection. The parameter "published_at" is not properly sanitized due to an erroneous regular expression. "Blog publisher" rights are needed to exploit this issue. 3. The application uses a salt when storing the password hashes, but the salt is set to a hardcoded value making the salt less efficient as equal passwords result in the same hash value. --------- Timeline: --------- 2008-09-29 - vendor informed 2008-10-02 - vendor informed 2008-10-30 - no response from vendor, public disclosure

References:

http://xforce.iss.net/xforce/xfdb/46204


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top