Xoops 1.3.5 - Private Message System Font Attributes HTML Injection

source: https://www.securityfocus.com/bid/6344/info

Xoops includes a Private Message System for users, so that they may send messages to one another. HTML tags used for font attributes are not sufficiently filtered of malicious HTML code. This makes it possible for an attacker to supply malicious input in the HTML font tags that contain arbitrary script code. When another user receives the attacker's private message, the malicious script code will be executed on that user in the context of the site running Xoops.

<b onMouseOver="alert(document.location);">test</b>
<i onClick="alert(document.location);">test</i>
<u onClick="alert('Hello');">test</u>