----------------------------------------------------------------------

Try a new way to discover vulnerabilities that ALREADY EXIST in your
IT infrastructure.

The Secunia NSI enables you to INSPECT, DISCOVER, and DOCUMENT
vulnerabilities in more than 4,700 different Windows applications.

Request your account, the Secunia Network Software Inspector (NSI):
http://secunia.com/network_software_inspector/

----------------------------------------------------------------------

TITLE:
Simple PHP Blog Cross-Site Scripting and File Upload Vulnerabilities

SECUNIA ADVISORY ID:
SA26968

VERIFY ADVISORY:
http://secunia.com/advisories/26968/

CRITICAL:
Moderately critical

IMPACT:
Cross Site Scripting, System access

WHERE:
>From remote

SOFTWARE:
Simple PHP Blog 0.x
http://secunia.com/product/5342/

DESCRIPTION:
Luca "ikki" Carettoni and Luca "Daath" De Fulgentis have reported
some vulnerabilities in Simple PHP Blog, which can be exploited by
malicious people to conduct cross-site scripting attacks and by
malicious users to compromise a vulnerable system.

1) Input passed to the "user_colors[bg_color]" parameter in the file
\themes\<theme name>\user_style.php is not properly sanitised before
being returned to the user. This can be exploited to execute
arbitrary HTML and script code in a user's browser session in context
of an affected site.

Successful exploitation requires that "register_globals" is enabled.

2) The upload_img_cgi.php script does not correctly restrict certain
types of uploaded files. This can be exploited to e.g. execute
arbitrary PHP code by uploading a specially crafted PHP script that
contains the GIF magic number.

This is related to:
SA16598

The vulnerabilities are reported in versions prior to 0.5.1.

SOLUTION:
Update to version 0.5.1.

PROVIDED AND/OR DISCOVERED BY:
Luca "ikki" Carettoni and Luca "Daath" De Fulgentis, SecureNetwork.IT

ORIGINAL ADVISORY:
Simple PHP Blog:
http://www.simplephpblog.com/index.php?entry=entry070923-004446

SecureNetwork.IT:
http://www.securenetwork.it/ricerca/advisory/download/SN-2007-03.txt

OTHER REFERENCES:
SA16598:
http://secunia.com/advisories/16598/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------