phpBB Improper Input Sanitization Vulnerability

vendor:

phpBB

by:

SecurityFocus

7.5

CVSS

HIGH

Improper Input Sanitization

CWE

Product Name: phpBB

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2002

phpBB Improper Input Sanitization Vulnerability

phpBB does not properly sanitize user input in forum postings. This could allow a malicious user to inject script code into a forum post which would in turn be executed when the page is viewed by other users. Script code would be executed in the security context of the phpBB site. Supplied script code may access authentication credentials, or take actions as an authenticated user.

Mitigation:

Input validation should be used to ensure that user-supplied data is properly sanitized.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/6248/info

phpBB does not properly sanitize user input in forum postings. This could allow a malicious user to inject script code into a forum post which would in turn be executed when the page is viewed by other users.

Script code would be executed in the security context of the phpBB site.

Supplied script code may access authentication credentials, or take actions as an authenticated user.

<b onMouseOver="alert(document.location);">This piece of text could be
dangerous if you were to move your mouse over it!</b>

<i onClick="alert(document.location);">This piece of text could be dangerous
if you were to click it!</i>

<u onClick="alert('Hello');">This piece of text could be dangerous if you
were to click it!</u>