The host is running tDiary and is prone to Cross-Site Scripting Vulnerability.

Successful exploitation will allow remote attackers to execute arbitrary HTML and script code in a user's browser session in the context of an affected site. Impact Level: Application

Update to version 2.2.3 or later. For updates refer to http://www.tdiary.org/

The flaw is due to improper validation of the 'plugin_tb_url' and 'plugin_tb_excerpt' parameters upon submission to the tb-send.rb plugin script.

tDiary versions prior to 2.2.3

• http://jvndb.jvn.jp/en/contents/2010/JVNDB-2010-000005.html
• http://osvdb.org/62562
• http://secunia.com/advisories/38742
• http://tdiary.svn.sourceforge.net/viewvc/tdiary/branches/Stable-2_2/plugin/tb-send.rb?r1=3238&r2=3573
• http://www.tdiary.org/20100225.html

---

Updated on 2015-03-25