Description
Two vulnerabilities exist in index.php of BlogPHP 2.0. The id parameter used by a page action is concatenated into an SQL statement without sanitization, allowing arbitrary SQL commands to be executed. The search parameter is reflected in the page output without HTML encoding, allowing arbitrary script or HTML to be injected.
Impact
SQL injection lets an attacker read the whole database, including the administrator password hash, and take over the blog. The cross-site scripting issue lets an attacker run JavaScript in the browser of any visitor who follows a crafted search link, which enables session hijacking and credential theft.
Solution
Use parameterized queries for the id parameter and encode the search parameter before writing it to the page. Upgrade to a maintained blogging platform.