Cross-Site Scripting Vulnerability in Newtelligence DasBlog Community Edition
Dominick Baier <firstname.lastname@example.org>
A XSS (Cross-Site-Scripting) Vulnerability in DasBlog’s Event Viewer allows to inject and execute code on the client’s machine. This allows an attacker to transfer the ASP.NET authentication cookie to a server of his choice. The attacker can use this cookie to log on to DasBlog and modify blog entries and configuration settings.
2. Severity : Critical
3. Systems affected
Tested with IE 6 and Firefox 1.0
Examples of script injections
Embed script code in the ViewState and send it to dasBlog
Install the latest Version (which is by the time of writing 1.7.5016.2)
The informations in this advisory are provided “AS IS” without warranty
of any kind. In no event shall the authors be liable for any damages
whatsoever including direct, indirect, incidental, consequential,
loss of business profits or special damages due to the misuse of any
information provided in this advisory.