Invision Power Board D22-Shoutbox HTML Injections

2007.08.24
Credit: DoZ
Risk: Low
Local: No
Remote: Yes
CWE: CWE-Other


CVSS Base Score: 4.3/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

[HSC] Invision Power Board D22-Shoutbox HTML Injections D22-Shoutbox suffers from improper validation of HTMl tags filtration. An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. A successful script could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. Hackers Center Security Group (http://www.hackerscenter.com) Credit: Doz Class: Input Validation Error Remote: Yes Local: N/A Product: D22-Shoutbox Version: N/A Vendor: http://www.dscripting.com/ Exploit is not needed, Attackers can exploit these issues via a web client. Only becoming a hacker you can stop a hacker. Were can you learn with out having to pay thousands!- http://kit.hackerscenter.com - The most comprehensive security pack you will ever find on the net!


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top