Exploit YaBB 1 - Invalid Topic Error Page Cross-Site Scripting

[Exploiter]

EDB-ID

21573

Проверка EDB

1. Пройдено

Автор

METHODIC

Тип уязвимости

WEBAPPS

Платформа

CGI

CVE

cve-2002-0955

Дата публикации

2002-06-21

source: https://www.securityfocus.com/bid/5078/info

It is reported possible for attackers to construct a URL that will cause scripting code to be embedded in error pages.

YaBB fails to check URLs for the presence of script commands when generating error pages, allowing attacker supplied code to execute. If such a URL is sent to a YaBB user, upon accessing the link, the attacker-supplied code will run in the context of the site running the vulnerable software.

This issue may be exploited to steal cookie-based authentication credentials from legitimate users of YaBB. 

http://some.site.com/cgi-bin/YaBB/YaBB.cgi?board=BOARD&action=display&num=<script>alert()</script>