13 lines
No EOL
678 B
Text
13 lines
No EOL
678 B
Text
source: http://www.securityfocus.com/bid/12888/info
|
|
|
|
Invision Power Board is reported prone to an HTML injection vulnerability. This issue arises due to insufficient sanitization of user-supplied data.
|
|
|
|
It is reported that due to a lack of filtering of HTML tags, an attacker can inject an IFRAME through an HTTP POST request.
|
|
|
|
All version of Invision Power Board are considered vulnerable at the moment.
|
|
|
|
This BID will be updated when more information is available.
|
|
|
|
<iframe id="frame1" name="frame1" frameborder=0 width=0 height=0
|
|
src="http://www.example.com/forums/index.php?act=Msg&CODE=04&MODE=1&entered_name=Woody&msg_title=hi&Post=I%20love%20you!">
|
|
</iframe> |