Release Date: 2003-12-23
Critical: Less critical
Impact: Cross Site Scripting
Where: From remote
Software: My Little Forum 1.x
Description:
David Sopas Ferreira has reported vulnerabilities in My Little Forum, which can be exploited by malicious people to conduct Cross-Site Scripting attacks.
The vulnerabilities are caused due to missing validation of input supplied to the "forum_contact", "category", and "page" parameters. This can be exploited to execute arbitrary HTML or script code in a user's browser session when viewed.
Example:
http://[victim]/forum/email.php?forum_contact=">
The vulnerabilities have been reported in version 1.3. Other versions may also be affected.
Solution:
Edit the source code to ensure proper input validation is performed.
Filter malicious characters and character sequences in a HTTP proxy or firewall with URL filtering capabilities.
Provided and/or discovered by:
David Sopas Ferreira
Source: Secunia