AOH :: HP Unsorted S :: C07-1992.HTM

SMF "index.php?action=pm" Cross Site-Scripting



SMF "index.php?action=pm" Cross Site-Scripting
SMF "index.php?action=pm" Cross Site-Scripting



#Aria-Security Team
#http://Aria-Security.com 
#Type:Remote Cross-Site Scripting
#Article on XSS: http://aria-security.net/xss.rar 
#Discovered By Aria-Security Team
#Tested on SMF 1.1 RC3
#
#Explanation:
#
#-First of all user must be REGISTERED
#-Go to http://target/smf/index.php?action=pm;sa=send 
#-Inster your xss code for the recipient or BCC
#-Press send.



Original Advisory:
http://aria-security.com/forum/showthread.php?p=128 

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.