FlatPress 1.0.2 - Cross-site Scripting
Overview #
Cross-site Scripting (XSS) vulnerabilities exist in FlatPress version 1.0.2. FlatPress is a blogging engine that saves posts as simple text files.
Vulnerability Details #
Affected Versions: 1.0.2 and earlier
Root Cause: Insufficient input validation in the content parameter allows XSS attacks.
Technical Details #
POST /?x=entry:entry131123-000300 HTTP/1.1
content=</textarea><script>alert(9)</script>Exploitation Requirements #
- Authentication may be required
- Victim must view the malicious content
Impact #
Remote attackers can exploit these vulnerabilities to:
- Steal user session cookies
- Perform actions on behalf of users
- Persistently inject malicious content
Solution #
Update to a patched version. See GitHub Issue #14.