Secunia Advisory: SA10489 Print Advisory
Release Date: 2003-12-23

Critical: Less critical
Impact: Cross Site Scripting
Where: From remote

Software: My Little Forum 1.x


Description:
David Sopas Ferreira has reported vulnerabilities in My Little Forum, which can be exploited by malicious people to conduct Cross-Site Scripting attacks.

The vulnerabilities are caused due to missing validation of input supplied to the "forum_contact", "category", and "page" parameters. This can be exploited to execute arbitrary HTML or script code in a user's browser session when viewed.

Example:
http://[victim]/forum/email.php?forum_contact=">

The vulnerabilities have been reported in version 1.3. Other versions may also be affected.

Solution:
Edit the source code to ensure proper input validation is performed.

Filter malicious characters and character sequences in a HTTP proxy or firewall with URL filtering capabilities.

Provided and/or discovered by:
David Sopas Ferreira

Source: Secunia

OS/2-eCS-ArcaOS General News

More in General  

OS/2-eCS-ArcaOS Software News

More in Software  

Latest Forum Posts

Site News

More in Site News