Release Date: 2003-12-30
Critical: Less critical
Impact: Cross Site Scripting
Where: From remote
Software: miniBB 1.x
Description:
Chintan Trivedi has reported a vulnerability in miniBB, allowing malicious users to conduct cross-site scripting attacks.
The problem is that the website URL, which users can include in their profile, isn't sanitised. This can be exploited by including arbitrary HTML or script code in the URL, which will be executed in a user's browser session in context of the affected site, when the profile is viewed.
The vulnerability has been reported in version 1.7 and prior.
Solution:
Edit the source code to ensure that user input is properly verified.
Provided and/or discovered by:
Chintan Trivedi
Source: Secunia