Bugtraq mailing list archives
A Phorum's bug...
From: WiciU <vviciu () poczta onet pl>
Date: 9 May 2003 17:37:09 -0000
Hi! I have founded a bug in Phorum (http://phorum.org/). It is possible to inject script code or other html-tag into "subject", "author's name" or "author's e-mail" of a message in Phorum. In the subject (name, e-mail) input of message you need to write any html-tag like this: <<b>script>alert(document.cookie);<<b>/script> I have tested it on Phorum 3.4.1 but probably works in other Phorum 3.x.x versions. Greetings! WiciU, Poland vviciu () poczta onet pl
Current thread:
- A Phorum's bug... WiciU (May 09)
- <Possible follow-ups>
- Re: A Phorum's bug... Brian Moon (May 09)