Full Disclosure mailing list archives
[SePro] WBB - WoltLab Burning Board <= 2.3.1 - XSS Vulnerability (22.04.05)
From: "deluxe 89" <deluxe89 () web de>
Date: Fri, 22 Apr 2005 20:58:46 +0200
[SePro] WBB - WoltLab Burning Board <= 2.3.1 - XSS Vulnerability (22.04.05) Vendor: WoltLab URL: http://www.woltlab.de/ Version: <= 2.3.1 Type: XSS Discovered by deluxe89 Contact: deluxe[@]security-project.org Description: -------------------------------- The WoltLab Burning Board is a high customisable forum software for every kind of use. See [1] for a detailed description. Cross Site Scripting: -------------------------------- It's possible to inject HTML or JavaScript code into the variable "hilight" of thread.php. http://www.it-security23.net/thread.php?threadid=1683&hilight=[XSS] Solution: -------------------------------- There isn't a solution yet. Security-Project -------------------------------- http://www.security-project.org Vendor contacted. Greetz to Astovidatu, DooMRunneR, Wacholdernutte and Doc [1] http://www.woltlab.de/products/burning_board/index_en.php ______________________________________________________________ Verschicken Sie romantische, coole und witzige Bilder per SMS! Jetzt bei WEB.DE FreeMail: http://f.web.de/?mc=021193 _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- [SePro] WBB - WoltLab Burning Board <= 2.3.1 - XSS Vulnerability (22.04.05) deluxe 89 (Apr 22)