PHP Prayer Board Cross-Site Scripting Vulnerability

Bugtraq ID:	8775
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 06 2003 12:00AM
Updated:	Oct 06 2003 12:00AM
Credit:	This vulnerability was announced in a vendor changelog.
Vulnerable:	PHP Prayer Board PHP Prayer Board 0.51
Not Vulnerable:	PHP Prayer Board PHP Prayer Board 0.52

PHP Prayer Board Cross-Site Scripting Vulnerability

PHP Prayer Board has been reported prone to a cross-site scripting vulnerability.

The issue presents itself due to a lack of sufficient sanitization performed by functions in PHP Prayer Board scripts on user-influenced form data and URI parameters. It has been reported that a remote attacker may construct a malicious link to the vulnerable script and supply arbitrary HTML code as URI parameters. If this link is followed, malicious HTML code will be rendered in the browser of the user who followed the link.

This could permit the theft of cookie authentication credentials; other attacks may also be possible.

PHP Prayer Board Cross-Site Scripting Vulnerability

This vulnerability can be exploited using a web browser.

PHP Prayer Board Cross-Site Scripting Vulnerability

Solution:
The vendor has released an update to address this issue:


PHP Prayer Board PHP Prayer Board 0.51

• PHP Prayer Board phpprayboard-0.52.tar.bz2
  http://prdownloads.sourceforge.net/phpprayerboard/phpprayboard-0.52.ta r.bz2?download