Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!

TUCoPS :: Web BBS :: etc :: bt66.txt

Onecenter forum 4.0 XSS

Issue : cross site scripting in Onecenter forum

Affected Product : Onecenter forum 4.0

Description :

Onecenter offers a free discussion forum hosted in the company's servers ( ) . Any user in the forum is identified by a cookie
that contains nick , name , mail address and password . This information
can be easily obtained as you can add in your posts the img html tag with
a custom script as follows
<img src=javascript:alert(document.cookie);>

To impersonate any user in the forum ( onecenter administrators would be a
good choice ) you just have to build a cookie like the one obtained and
visit the forum .

Regards ,

David F. Madrid
Madrid , Spain

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH