Description
SQL injection and cross-site scripting (XSS) vulnerabilities exist in A-Blog V.2 through the id parameter. The parameter is not properly sanitized for database queries or HTML output.
Impact
SQL injection allows attackers to extract the entire database including user credentials and blog content. XSS enables session hijacking and administrative account compromise.
Solution
Apply parameterized queries and output encoding. Migrate to a maintained blogging platform.