Ultimate PHP Board ViewTopic.PHP Cross Site Scripting Vulnerability

Bugtraq ID:	6335
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 08 2002 12:00AM
Updated:	Dec 08 2002 12:00AM
Credit:	Vulnerability discovery credited to "euronymous" <[email protected]>.
Vulnerable:	Ultimate PHP Board Ultimate PHP Board 1.0 final beta
Not Vulnerable:

Ultimate PHP Board ViewTopic.PHP Cross Site Scripting Vulnerability

Ultimate PHP Board (UPB) is a freely available, open source PHP Bulletin Board. It is available for the Unix and Linux operating systems.

By passing a malicious script code to the viewtopic.php script, UPB may return the script code to the browser of the user visiting the malicious URL. This could lead to the execution of HTML and script code in the security context of the UPB site.

Ultimate PHP Board ViewTopic.PHP Cross Site Scripting Vulnerability

http://example.com/phorum/viewtopic.php?id=%3Cscript%3Ealert(document.cookie)%3C%2Fscript%3E&t_id=2

Ultimate PHP Board ViewTopic.PHP Cross Site Scripting Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Ultimate PHP Board ViewTopic.PHP Cross Site Scripting Vulnerability

References:

• XSS and Path Disclosure in UPB ("euronymous" )