Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!

TUCoPS :: Web BBS :: etc :: bt1433.txt

Led-Forums multiple vulns

Product: Led-Forums 

Versions: Beta 1 

Vulnerability: XSS- and redirection-Bug 

Date: October 30, 2003 

Discovered by: ProXy <> 

1. - XSS-Bug 

The Welcome-Message of the Led-Forums software could be changed by everybody. 

Normal Text, HTML and Javascript it's all allowed! :) 





2. - Redirection-Bug 

HTML-tags are allowed in topic-names as well as Javascript. 

So if anybody insert the following JS-code in the topic-field of a new thread 

the complete forum-category would be redirected to the adress the attacker indicates. 


- ProXy 


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH