[31047] in bugtraq
ZH2003-14SA (security advisory): aspBoard XSS Vulnerability
daemon@ATHENA.MIT.EDU (G00db0y)
Tue Aug 5 14:10:40 2003
Date: 5 Aug 2003 10:05:00 -0000
Message-ID: <20030805100500.6837.qmail@www.securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: G00db0y <G00db0y@zone-h.org>
To: bugtraq@securityfocus.com
ZH2003-14SA (security advisory): aspBoard XSS Vulnerability
Published: 5 august 2003
Released: 5 august 2003
Name: aspBoard
Affected Systems: 1.2
Issue: Remote attackers can inject XSS script
Author: G00db0y@zone-h.org
Vendor: http://www.freezingcold.com
Description
***********
Zone-h Security Team has discovered a flaw in
aspBoard 1.2 (and older versions?). aspBoard is a
"Message Board Component for ASP Internet Applications".
Details
*******
The posting procedure needs: Your Name, Your Email, Your
URL, a subject and your message. It's possible to inject
XSS script in the url variable.
For example try this:
Your Name: John Doe
Your Email: johndoe@johndoe.com
Your URL: <script>alert('Zone-h')</script>
Subject: Hi
Your Message: Zone-h Security Team
Solution:
*********
The vendor has been contacted and a patch is not yet produced
Suggestions:
************
Filter the script
G00db0y - www.zone-h.org admin
Original advisory here: http://www.zone-h.org/en/advisories/read/id=2834/
