Full Disclosure mailing list archives
Re: Invision Iframe Bug
From: Paul Laudanski <zx () castlecops com>
Date: Thu, 24 Mar 2005 15:53:03 -0500 (EST)
On Thu, 24 Mar 2005, Woody wrote:
Hi, I've found a bug in Invision Board, it let's you send private messages around, change people their signature, avatar, etc. If the administrator doesn't filter all the html tags on a forum (or just forgets, which is often the case) you can add an invisible iframe to your post. Now if you just figure out how invision board sends for example a private message, you can let people send one to someone.
Just out of curiosity, which version of the software did you test this on, and which if any are immune? -- Sincerely, Paul Laudanski .. Computer Cops, LLC. CastleCops(SM)... http://castlecops.com CC Blog ......... http://blog.castlecops.com Staff Blogs ..... http://busterbunny.castlecops.com Our Vision ...... http://castlecops.com/postt63382.html http://cuddlesnkisses.com http://justalittlepoke.com http://zhen-xjell.com _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Invision Iframe Bug Woody (Mar 24)
- Re: Invision Iframe Bug Paul Laudanski (Mar 24)