AZ Bulletin Board post.php script cross-site scripting
| azbulletinboard-post-xss (24274) |  Medium Risk |
Description:
AZ Bulletin Board is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the post.php script. A remote attacker could exploit this vulnerability using the topic or name parameters to execute script in a victim's Web browser within the security context of the hosting Web site, allowing the attacker to steal the victim's cookie-based authentication credentials.
Platforms Affected:
- Azbb, AZ Bulletin Board 1.1.00 and prior
Remedy:
No remedy available as of July 4, 2009.
Consequences:
Gain Access
References:
- AZ Bulletin Board Download Web page, AZbb :: AZ Bulletin Board at http://azbb.cyaccess.com/index.php?1091872271.
- AZ Bulletin Board Web site, Welcome to AZ Bulletin Board at http://azbb.cyaccess.com/.
- BID-16351: AZ Bulletin Board Post.PHP HTML Injection Vulnerabilities
- CVE-2006-0407: Cross-site scripting (XSS) vulnerability in post.php in AZ Bulletin Board (AZbb) 1.1.00 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) nickname parameter and (2) an iframe tag in the topic parameter. NOTE: the original disclosure specified the name parameter, but a correction was later provided. NOTE: followup posts have both disputed and confirmed the original claim.
- SA18565: AZ Bulletin Board Cross-Site Scripting Vulnerabilities
- VUPEN/ADV-2006-0298: AZ Bulletin Board topic and name Cross Site Scripting Vulnerabilities
Reported:
Jan 23, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net