• info
• discussion
• exploit
• solution
• references

Private Message System index.php Page Parameter Cross-Site Scripting Vulnerability

Private Message System is prone to a cross-site scripting vulnerability. This issue may be exploited by creating a malicious link to a site hosting the software with hostile HTML and script code embedded in URI parameters. If the link is followed, the attacker-supplied code may be rendered in the victim user's browser.

Possible consequences of exploitation include theft of cookie-based authentication credentials or using the issue as an attack vector to exploit latent web browser security flaws.