Irokez Blog BLIND SQL-INJECTION, INCLUDE, ACTIVE XSS
A Blind SQL-Injection vulnerability was discovered in Irokez Blog. An attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to the vulnerable application. The application does not properly sanitize user-supplied input before using it in an SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. An attacker can also exploit an Include vulnerability in the application. An attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to the vulnerable application. The application does not properly sanitize user-supplied input before using it in an include statement. This can be exploited to include arbitrary files from local or external resources. An Active XSS vulnerability was also discovered in the application. An attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to the vulnerable application. The application does not properly sanitize user-supplied input before using it in an HTML output. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
