Subject: FC2 BLOG Cross-Site Scripting Vulnerabilities Application: FC2 BLOG Vendor:BLOG.FC2.COM Corporation: FC2, Inc. DATE : 9 Oct 2008 Description: FC2 BLOG Cross-Site Scripting Vulnerabilities Vulnerability: ============== They do not properly sanitize the potentially malicious input content to be rendered and, as a result, an attacker might provide malicious HTML content as part of A New Entry. Exploit: ============== Write A New Entry in FC2 blog: <input type="image" src="x" onerror="javascript:alert(/XSP/)" /> ============== xisigr[topsec] xisigr@xxxxxxxxx
