7 lines
No EOL
723 B
Text
7 lines
No EOL
723 B
Text
source: https://www.securityfocus.com/bid/9822/info
|
|
|
|
It has been reported that Invision Power Board may be prone to a cross-site scripting vulnerability. This may allow a remote attacker to cause hostile HTML or script code to be rendered in a user's browser via a malicious link to a vulnerable site.. The issue presents itself due to insufficient sanitization of user-supplied data via the 'pop' URI parameter, which will be included in dynamically generated web pages.
|
|
|
|
Invision Power Board 1.3 Final has been reported to be affected by this issue, however, it is possible that other versions are vulnerable as well.
|
|
|
|
http://<host>/forum//index.php?s=&act=chat&pop=1;'><script>alert('this could be your cookie')</script> |