Description
SQL injection and cross-site scripting (XSS) vulnerabilities exist in A-Blog V.2. The id parameter of blog.php in a news action is placed into a database query without sanitization, and the words parameter of search.php is reflected in the page without HTML encoding.
Impact
SQL injection allows attackers to extract the entire database including user credentials and blog content. XSS enables session hijacking and administrative account compromise.
Solution
Apply parameterized queries and output encoding. Migrate to a maintained blogging platform.