[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <i6ug8m$ald$1@dough.gmane.org>
Date: Thu, 16 Sep 2010 20:29:08 -0500
From: Raphael Geissert <geissert@...ian.org>
To: oss-security@...ts.openwall.com
Subject: CVE request: pixelpost
Hi everyone,
Multiple vulnerabilities have been reported against pixelpost:
1) A CSRF vulnerability allows changes to some settings (PoC allows changing
the administrator's password.) [1]
2) SQL injection [2]
3) XSS [2]
2) and 3) are from 2009, so I guess we are going to need some help from
Steven for those ones. The only information about those is [3] which has
some other changes.
It also appears to be using PHP_SELF in some places, so that's another XSS
vector. Will confirm it later.
[1] http://www.exploit-db.com/exploits/15014/
[2] http://www.pixelpost.org/blog/2009/09/02/pixelpost-173-security-update/
[3] http://pastie.textmate.org/616485
Cheers,
--
Raphael Geissert - Debian Developer
www.debian.org - get.debian.net
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
