Cross-site scripting in Geeklog - CVE-2011-4942

Detailed vulnerability description

Vulnerability allows a remote attacker to perform Cross-site scripting attacks.

An input validation error exists in admin/configuration.php in Geeklog before 1.7.1sr1 when processing the (1) subgroup or (2) conf_group parameters. NOTE: this vulnerability might require a user-assisted attack or a bypass of a CSRF protection mechanism. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

How to mitigate CVE-2011-4942

Sources

• http://secunia.com/advisories/42775
• http://www.geeklog.net/article.php/geeklog-1.7.1sr1
• http://www.openwall.com/lists/oss-security/2011/03/18/8
• http://www.openwall.com/lists/oss-security/2012/03/23/13
• http://www.openwall.com/lists/oss-security/2012/03/23/5
• http://www.osvdb.org/70245
• http://yehg.net/lab/pr0js/advisories/%5Bgeeklog1.7.1%5D_cross_site_scripting