vendor:
IP.Board
by:
milw0rm.com
8,8
CVSS
HIGH
Cross-site Scripting (XSS) and Path Disclosure
79, 200
CWE
Product Name: IP.Board
Affected Version From: 3.0.0 Beta 5
Affected Version To: 3.0.0 Beta 5
Patch Exists: YES
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Internet Explorer 6,7,8 and Firefox 2.0
2009
Active XSS in message body or signature and Path disclosure in IP.Board 3.0.0 Beta 5
A vulnerability in IP.Board 3.0.0 Beta 5 allows an attacker to inject malicious JavaScript code into the message body or signature of a user. This code will be executed in the context of the user's browser when the message is viewed. Additionally, a path disclosure vulnerability exists in the same version of IP.Board, which allows an attacker to view the full path of the application on the server.
Mitigation:
Upgrade to the latest version of IP.Board
