('binary' encoding is not supported, stored as-is) Description: It is possible to insert javascript code in a message and execute it. 1.) go to a phorum 2.) click on new topic 3.) enter any name 4.) enter any email 5.) enter a title in the way like this "><script>alert ("Vulnerable");</script> 6.) enter any text 7.) click the preview button 8.) click the send button on the top of the page Solution: Edit the source code to strip malicious characters from title or escape malicious characters using addslashes().
This archive was generated by hypermail 2b30 : Wed Apr 02 2003 - 12:47:10 PST