DCForum+ subject heading message cross-site scripting
| dcforum-subject-message-xss (12879) |  Medium Risk |
Description:
DCForum is vulnerable to cross-site scripting. A remote attacker could post a message containing malicious HTML or JavaScript embedded within the subject field, which would be executed in the victim's Web browser within the security context of the hosting site, once the message is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
Platforms Affected:
- DCScripts, DCForum+ 1.2
Remedy:
Reportedly, there is a patch for this vulnerability, available from the DCScripts Web site. See References.
Consequences:
Gain Access
References:
- DCScripts Web site, DCForum+ - PhP MySQL Discussion forum and web conferencing Sofware by DCScripts at http://www.dcscripts.com/dcforump.shtml.
- Zone-h Security Advisory ZH2003-21SA, DcForum+ XSS Vulnerability at http://archives.neohapsis.com/archives/bugtraq/2003-08/0107.html.
- BID-15885: DCForum DCBoard Script Page Parameter Cross-Site Scripting Vulnerability
- BID-8384: DCForum+ Subject Field HTML Injection Vulnerability
- CVE-2005-4311: Cross-site scripting (XSS) vulnerability in DCForum 6.25 and earlier, and possibly DCForum+ 1.x, allows remote attackers to inject arbitrary web script or HTML via (1) the page parameter in dcboard.php and (2) unspecified search parameters.
- SA18093: DCForum+ Cross-Site Scripting Vulnerabilities
- VUPEN/ADV-2005-2940: DCForum+ Multiple Parameters Cross Site Scripting Vulnerabilities
Reported:
Aug 10, 2003
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net