Home page logo
/

bugtraq logo Bugtraq mailing list archives

A Phorum's bug...
From: WiciU <vviciu () poczta onet pl>
Date: 9 May 2003 17:37:09 -0000



Hi!
I have founded a bug in Phorum (http://phorum.org/).
It is possible to inject script code or other html-tag into "subject",
"author's name" or "author's e-mail" of a message in Phorum.
In the subject (name, e-mail) input of message you need to write any
html-tag like this:
<<b>script>alert(document.cookie);<<b>/script>
I have tested it on Phorum 3.4.1 but probably works in other Phorum 3.x.x
versions.
Greetings!

WiciU, Poland
vviciu () poczta onet pl


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault