XOOPS HTML Injection Vulnerability
BID:5785
Info
XOOPS HTML Injection Vulnerability
| Bugtraq ID: | 5785 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 24 2002 12:00AM |
| Updated: | Sep 24 2002 12:00AM |
| Credit: | Discovery of this vulnerability credited to [email protected]. |
| Vulnerable: |
Xoops Xoops 1.0 RC3 |
| Not Vulnerable: |
Xoops Xoops 1.0 RC3.0.5 |
Discussion
XOOPS HTML Injection Vulnerability
Problems with XOOPS could make it possible to execute arbitrary script code in a vulnerable client.
XOOPS does not sufficiently filter potentially malicious HTML code from posted messages. As a result, when a user views a message posting that contains malicious HTML code, the code contained in the message would be executed in the browser of the vulnerable user. This will occur in the context of the site running the XOOPS software.
Problems with XOOPS could make it possible to execute arbitrary script code in a vulnerable client.
XOOPS does not sufficiently filter potentially malicious HTML code from posted messages. As a result, when a user views a message posting that contains malicious HTML code, the code contained in the message would be executed in the browser of the vulnerable user. This will occur in the context of the site running the XOOPS software.