text_combined: ulf harnhammar ulfhupdateuuse geeklog xss crlf injection program geeklog vendor tony bibbs et al homepage httpgeeklogsourceforgenet vulnerable versions 135sr1 possibly earlier versions well vulnerable versions 135sr2 login required severity high description geeklog blog otherwise known weblog allows create virtual community area complete user administration story posting messaging comments polls calendar weblinks run many different operating systems uses php4 mysql direct quote programs homepage geeklog published terms gnu general public license security holes 1 geeklog got xss hole affects stories comments program removes html elements used scripting fails remove html attributes used purpose leads hole one example xss attack would life made much bolder victim moves mouse pointer quote lady godivas operation intrinsic event occurs javascript code executed also xss issue search engine reported ome1 2 geeklog got crlf injection hole user profile send email users mail addresses meant secret using hole get someones mail address anyway problem add extra mail headers using crlf combination followed extra mail header subject field one way add saving html document form changing tag textarea opening edited document web browser enter subject line textarea press enter enter extra mail header mail sent header included header question bcc message silently copied thus revealing recipients mail address without knowing described type problem detail crlf injection paper available httpcertunistuttgartdearchivebugtraq200205msg00079html communication vendor vendor contacted 1st july version 135sr2 security holes neither mine ome1s released 9th july recommendation recommend administrators upgrade version 135sr2 ulf harnhammar ulfhupdateuuse fri 19 jul 2002 022352 0200 cest vulnwatch geeklog xss crlf injection