[24447] in bugtraq
RE: Open Bulletin Board javascript bug.
daemon@ATHENA.MIT.EDU (Justin)
Wed Feb 27 21:23:39 2002
From: "Justin" <jwgolihew@cs.millersville.edu>
To: <bugtraq@securityfocus.org>
Date: Tue, 26 Feb 2002 21:05:07 -0500
Message-ID: <NGEAKMNNFCGJKEKPAJAPMEAKCAAA.jwgolihew@cs.millersville.edu>
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
In-Reply-To: <001301c1bef2$d7761e10$0b00000a@god>
Snitz Forums 2000, another free bulletin board software is also vulnerable.
-----Original Message-----
From: godminus [mailto:godminus@owns.com]
Sent: Tuesday, February 26, 2002 1:24 PM
To: bugtraq@securityfocus.org
Subject: Re: Open Bulletin Board javascript bug.
> OpenBB is free php-based forum.
>
> Exploit:
> [img]javasCript:alert('Hello world.')[/img]
>
> Vulnerable systems:
> All versions of Open Bulletin Board including
> v.1.0.0
>
> Immune systems:
> None
>
> Solution:
> All url's in [img] tags should start
> with "http://"
>
> Yurij Rumiantsev
Ikonboard version 3.0.1 is vulnerable for the same bug
-- godminus
