phpBB 2.0.8a and lower - IP spoofing vulnerability

Advisory Name : phpBB 2.0.8a and lower - IP spoofing vulnerability Release Date : Apr 18, 2004 Application : phpBB Version : phpBB 2.0.8a and previous versions Platform : PHP Vendor URL : http://www.phpbb.com/ Author : Wang / SRR Project Group of Ready Response [email protected] Overview A...

phpBB IP address spoofing

The common.php script always trusts the X-Forwarded-For' header in the client's HTTP request. A remote user could forge this header in order to bypass any IP address access control lists ACLs...

Ikonboard 3.1.1 multiple crossite scriptings

Ikonboard 3.1.1 There are few ways to insert HTML tags into board content. 1. Via Photo URL. In profile user can set URL of photo. It's possible to insert URL like javascript:alertdocument.cookie Javascript will be triggered if someone accesses user's profile. 2. Via X-Forwarded-For: header. User...