My Little Forum Email.PHP Cross-Site Scripting Vulnerability

Bugtraq ID:	9286
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 23 2003 12:00AM
Updated:	Dec 23 2003 12:00AM
Credit:	Discovery of this vulnerability has been credited to "David S. Ferreira" <[email protected]>.
Vulnerable:	my little homepage my little forum 1.3
Not Vulnerable:

My Little Forum Email.PHP Cross-Site Scripting Vulnerability

my little forum is prone to a cross-site scripting vulnerability in the 'email.php' script. The source of the problem is that HTML and script code are not adequately sanitized from input supplied via the URI parameters. A remote attacker could exploit this issue by embedding hostile HTML and script code in a malicious link to the vulnerable script.

My Little Forum Email.PHP Cross-Site Scripting Vulnerability

The following proof of concept has been supplied:

http://www.example.com/forum/email.php?forum_contact="><script>alert(document.domain);</script>

My Little Forum Email.PHP Cross-Site Scripting Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

My Little Forum Email.PHP Cross-Site Scripting Vulnerability

References:

• my little homepage (my little homepage)