MiniBB Cross-Site Scripting Vulnerability

Bugtraq ID:	4619
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 17 2002 12:00AM
Updated:	Apr 17 2002 12:00AM
Credit:	Discovery of this issue is credited to frog frog <[email protected]>.
Vulnerable:	MiniBB MiniBB 1.2 - Apache Apache 1.3.24 - Apache Apache 1.3.24 - Apache Apache 1.3.23 - Apache Apache 1.3.23 - Apache Apache 1.3.22 - Apache Apache 1.3.22 - Apache Apache 1.3.20 - Apache Apache 1.3.20 - Apache Apache 1.3.19 - Apache Apache 1.3.19
Not Vulnerable:

MiniBB Cross-Site Scripting Vulnerability

MiniBB is web forum software. It is written in PHP and will run on most Unix and Linux variants as well as Microsoft Windows operating systems.

MiniBB does not filter script code from URL parameters, making it prone to cross-site scripting attacks.

This may enable a remote attacker to steal cookie-based authentication credentials from legitimate users of a website running MiniBB.

MiniBB Cross-Site Scripting Vulnerability

The following example may be used to reproduce this condition:

http://target/forums/index.php?action=search&searchFor="><script>alert("test")</script >

MiniBB Cross-Site Scripting Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

MiniBB Cross-Site Scripting Vulnerability

References:

• MiniBB Homepage (MiniBB)
  
• Security holes in 11 products... (frog frog )