DaCode 1.2 - News Message HTML Injection

2002-09-25T00:00:00
ID EXPLOITPACK:4935AD5135874EF229AC704188F47258
Type exploitpack
Reporter das@hush.com
Modified 2002-09-25T00:00:00

Description

DaCode 1.2 - News Message HTML Injection

                                        
                                            source: https://www.securityfocus.com/bid/5798/info

Problems with DaCode could make it possible to execute arbitrary script code in a vulnerable client.

DaCode does not sufficiently filter potentially malicious HTML code from news posts. As a result, when a user views a news posting that contains malicious HTML code, the code contained in the posted message would be executed in the browser of the vulnerable user. This will occur in the context of the site running the DaCode software. 

<IMG SRC="javascript:alert('unsecure')">