ToR PHP-I-BOARD Unspecified Cross Site Scripting and Directory Traversal Vulnerabilities

Bugtraq ID:	43840
Class:	Input Validation Error
CVE:	CVE-2009-2221 CVE-2009-2222
Remote:	Yes
Local:	No
Published:	Jun 25 2009 12:00AM
Updated:	Jun 25 2009 12:00AM
Credit:	Mr. Oono Noriko
Vulnerable:
Not Vulnerable:

ToR PHP-I-BOARD Unspecified Cross Site Scripting and Directory Traversal Vulnerabilities

ToR PHP-I-BOARD is prone to an unspecified cross-site scripting vulnerability and an unspecified directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting these issues will allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, or view arbitrary files in the context of the application. Other attacks are also possible.

PHP-I-BOARD 1.2 and prior are vulnerable.

ToR PHP-I-BOARD Unspecified Cross Site Scripting and Directory Traversal Vulnerabilities

Attackers can exploit these issues through a browser. To exploit the cross-site scripting issue the attacker must entice an unsuspecting victim into follow a malicious URI.

ToR PHP-I-BOARD Unspecified Cross Site Scripting and Directory Traversal Vulnerabilities

Solution:
Updates are available. Please see the references for more information.

ToR PHP-I-BOARD Unspecified Cross Site Scripting and Directory Traversal Vulnerabilities

References:

• PHP-I-BOARD directory traversal vulnerability in (JVN)
  
• PHP-I-BOARD is the cross-site scripting vulnerability. (JVN)
  
• PHP-I-BOARD Product Page (ToR)