Date: Thu, 16 Sep 2010 20:29:08 -0500 From: Raphael Geissert <geissert@...ian.org> To: oss-security@...ts.openwall.com Subject: CVE request: pixelpost Hi everyone, Multiple vulnerabilities have been reported against pixelpost: 1) A CSRF vulnerability allows changes to some settings (PoC allows changing the administrator's password.)  2) SQL injection  3) XSS  2) and 3) are from 2009, so I guess we are going to need some help from Steven for those ones. The only information about those is  which has some other changes. It also appears to be using PHP_SELF in some places, so that's another XSS vector. Will confirm it later.  http://www.exploit-db.com/exploits/15014/  http://www.pixelpost.org/blog/2009/09/02/pixelpost-173-security-update/  http://pastie.textmate.org/616485 Cheers, -- Raphael Geissert - Debian Developer www.debian.org - get.debian.net
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.