Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!

TUCoPS :: Web BBS :: etc :: bt1203.txt

Comment Board XSS Vulnerability

Comment Board XSS Vulnerability

Published: 24 September 2003

Released: 24 September 2003

Affected Systems: Comment Board


Issue: Remote attackers can inject XSS script. 



"Comment Board works straight away with little or no configuration required and 

provides a wealth of exciting features that will keep your web site visitors 

coming back for more. Check out our online demo and try a free downloadable 

version now."




It's possibile to inject XSS script in the Topic Title, Name and Message fields. 


"><script> this code will hide every thing after it including the the board topics

if any attacker write it in the topic title.

<script>"URL");</script> this code will open a new window when the

board loaded.



The vendor has been contacted and a patch is not yet produced.



Filter all variables. 

Discovered by / credit:


Bahaa Naamneh

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH