NPDS 4.8 News Message HTML Injection Vulnerability

ID EDB-ID:21860
Type exploitdb
Modified 2002-09-25T00:00:00


NPDS 4.8 News Message HTML Injection Vulnerability. CVE-2002-1804. Webapps exploit for php platform


Problems with NPDS could make it possible to execute arbitrary script code in a vulnerable client.

NPDS does not sufficiently filter potentially malicious HTML code from news posts. As a result, when a user views a news posting that contains malicious HTML code, the code contained in the posted message would be executed in the browser of the vulnerable user. This will occur in the context of the site running the NPDS software.

<IMG SRC="javascript:alert('unsecure')">