PBLang Bulletin Board System PM.PHP HTML Injection Vulnerability

Bugtraq ID:	12634
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 23 2005 12:00AM
Updated:	Feb 23 2005 12:00AM
Credit:	Discovery of this vulnerability is credited to HRG - Hackerlounge Research Group.
Vulnerable:	PBLang PBLang 4.65 PBLang PBLang 4.6
Not Vulnerable:

PBLang Bulletin Board System PM.PHP HTML Injection Vulnerability

PBLang is affected by a HTML injection vulnerability. This issue occurs because the application fails to properly sanitize user-supplied input.

The attacker-supplied HTML and script code would be able to access properties of the site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user, other attacks are also possible.

PBLang Bulletin Board System PM.PHP HTML Injection Vulnerability

No exploit is required.

PBLang Bulletin Board System PM.PHP HTML Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

PBLang Bulletin Board System PM.PHP HTML Injection Vulnerability

References:

• PBLang Forum Homepage (PBLang)
  
• Software PBLang 4.65 pm.php XSS vulnerability (HRG - Hackerlounge Research Group)