|
|
| |
| My Little Forum is "a simple web-forum that supports classical thread view (message tree) as well as message board view to display the messages". A cross-site scripting vulnerability in the product allows remote attackers to insert malicious HTML and/or JavaScript into existing web pages. |
| |
Credit:
The information has been provided by David S. Ferreira.
|
| |
Vulnerable systems:
* My Little Forum version 1.3
This PHP/MySQL based forum suffers from a cross-site scripting vulnerability. It can be exploited by including arbitrary HTML or even JavaScript code in the parameters (forum_contact, category and page), which will be executed in user's browser session when viewed.
Example:
The following URL can be used to test your system: http://vulnerablesite/forum/email.php?forum_contact="><script>alert(document.domain);</script>.
|
|
|
