NI3
11-02-2003, 12:54 PM
TITLE:
LedForums Cross-Site Scripting Vulnerabilities
SECUNIA ADVISORY ID:
SA10113
VERIFY ADVISORY:
[Only registered and activated users can see links]
CRITICAL:
Less critical
IMPACT:
Cross Site Scripting
WHERE:
From remote
SOFTWARE:
LedForums
DESCRIPTION:
Some vulnerabilities have been reported in LedForums, which can be
exploited by malicious users to conduct Cross-Site Scripting
attacks.
The vulnerabilities are caused due to missing validation of input
supplied to the "top_message" parameter in "index.php" and in topic
names. This can be exploited by including arbitrary HTML or script
code in the parameter or as a topic name, which will cause it to be
executed in a user's browser session when viewed.
Example:
[Only registered and activated users can see links][victim]/[path]/index.php?top_message=<script>alert(document.cookie)</script>
The vulnerabilities have been reported in LedForums Beta 1.
SOLUTION:
****** malicious input in a HTTP ***** or firewall with URL filtering
capabilities.
REPORTED BY / CREDITS:
*****
LedForums Cross-Site Scripting Vulnerabilities
SECUNIA ADVISORY ID:
SA10113
VERIFY ADVISORY:
[Only registered and activated users can see links]
CRITICAL:
Less critical
IMPACT:
Cross Site Scripting
WHERE:
From remote
SOFTWARE:
LedForums
DESCRIPTION:
Some vulnerabilities have been reported in LedForums, which can be
exploited by malicious users to conduct Cross-Site Scripting
attacks.
The vulnerabilities are caused due to missing validation of input
supplied to the "top_message" parameter in "index.php" and in topic
names. This can be exploited by including arbitrary HTML or script
code in the parameter or as a topic name, which will cause it to be
executed in a user's browser session when viewed.
Example:
[Only registered and activated users can see links][victim]/[path]/index.php?top_message=<script>alert(document.cookie)</script>
The vulnerabilities have been reported in LedForums Beta 1.
SOLUTION:
****** malicious input in a HTTP ***** or firewall with URL filtering
capabilities.
REPORTED BY / CREDITS:
*****