OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: skizzikimail.ru
Date: Fri Feb 22 2002 - 08:00:58 CST

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

       XMB is a php-based forum. This product contain a
    Cross Site Scripting vulnerability that allows
    attackers to insert JavaScript code (and other HTML
    code) into existing messages, bypassing the internal
    JavaScript/HTML code stripper.

       Exploit:
       [img]javasCript:alert('Hello world.')[/img]

       Vulnerable systems:
       All versions of XMB board, including last version -
       XMB 1.6x Magic Lantern

       Immune systems:
       None

       Possible solution:
       Searching the image URL for the text "javascript:"
    should solve the problem

                                          SliderGod.