XOOPS 1.0 RC3 HTML Injection Vulnerability

ID EDB-ID:21829
Type exploitdb
Reporter das@hush.com
Modified 2002-09-24T00:00:00


XOOPS 1.0 RC3 HTML Injection Vulnerability. CVE-2002-1802. Webapps exploit for php platform

                                            source: http://www.securityfocus.com/bid/5785/info

Problems with XOOPS could make it possible to execute arbitrary script code in a vulnerable client.

XOOPS does not sufficiently filter potentially malicious HTML code from posted messages. As a result, when a user views a message posting that contains malicious HTML code, the code contained in the message would be executed in the browser of the vulnerable user. This will occur in the context of the site running the XOOPS software.

<IMG SRC="javascript:[javascript]">