paBox pabox.php posticon Parameter XSS

The remote host is running paBox, a web application written in PHP. The remote version of paBox installed on the remote host does not properly sanitize input supplied through the 'posticon' parameter used to select a 'smilie' for a post. By exploiting this flaw, an attacker can inject HTML and...