Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Web BBS :: etc :: bt156.txt

Phorum - A Phorum's bug...







Hi!

I have founded a bug in Phorum (http://phorum.org/).

It is possible to inject script code or other html-tag into "subject",

"author's name" or "author's e-mail" of a message in Phorum.

In the subject (name, e-mail) input of message you need to write any

html-tag like this:

<<b>script>alert(document.cookie);<<b>/script>

I have tested it on Phorum 3.4.1 but probably works in other Phorum 3.x.x

versions.

Greetings!



WiciU, Poland

vviciu@poczta.onet.pl


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH