Secunia Advisory: SA10517 Print Advisory
Release Date: 2003-12-30

Critical: Less critical
Impact: Cross Site Scripting
Where: From remote

Software: miniBB 1.x


Description:
Chintan Trivedi has reported a vulnerability in miniBB, allowing malicious users to conduct cross-site scripting attacks.

The problem is that the website URL, which users can include in their profile, isn't sanitised. This can be exploited by including arbitrary HTML or script code in the URL, which will be executed in a user's browser session in context of the affected site, when the profile is viewed.

The vulnerability has been reported in version 1.7 and prior.

Solution:
Edit the source code to ensure that user input is properly verified.

Provided and/or discovered by:
Chintan Trivedi

Source: Secunia

OS/2-eCS-ArcaOS General News

More in General  

OS/2-eCS-ArcaOS Software News

More in Software  

Latest Forum Posts

Site News

More in Site News