`[KAPDA::#22] - Azbb v1.1.00 Cross Site Scripting KAPDA New advisory Vulnerable products : Azbb <= 1.1.00 Vendor: www.azbb.org Risk: Low Vulnerabilities: Cross Site Scripting Date : -------------------- Found : Jan 20 2006 Vendor Contacted : Jan 21 2006 Release Date : Jan 21 2006 About : -------------------- AZbb is "a forum that was written with a primary focus on security. AZbb does not require a database such as MySQL, PostgreSQL or MSSQL and can even be used as a blog, or a portal". Vulnerability: -------------------- Cross_Site_Scripting (XSS,CSS): AZ Bulletin Board is affected by a cross-site scripting vulnerability. This issue is due to the failure of the application to properly sanitize user-supplied input. As a result of this vulnerability, it is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of an unsuspecting user when followed. PoC : -------------------- 1) This flaw exists because the application does not validate the "nickname" variable upon submission to the post.php script via the POST method. h**p://www.[target]/post.php?nickname=">

Query Builder