Ikonboard User Profile Photo URI HTML Injection Vulnerability

Bugtraq ID:	6342
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 09 2002 12:00AM
Updated:	Dec 09 2002 12:00AM
Credit:	Discovery of this issue is credited to 3APA3A <[email protected]>.
Vulnerable:	Ikonboard.com ikonboard 3.1.1
Not Vulnerable:

Ikonboard User Profile Photo URI HTML Injection Vulnerability

Ikonboard does not sufficiently sanitize HTML from photo URIs in user profiles. An attacker may take advantage of this issue to embed malicious script code into their user profile. When the profile is viewed by other users, the attacker-supplied script code will execute in the security context of the site hosting the Ikonboard software.

This issue was reported in Ikonboard 3.1.1. Other versions may also be affected.

Ikonboard User Profile Photo URI HTML Injection Vulnerability

There is no exploit code required.

Ikonboard User Profile Photo URI HTML Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Ikonboard User Profile Photo URI HTML Injection Vulnerability

References:

• Ikonboard Homepage (Ikonboard)