vendor:
N/A
by:
Xianur0
7.5
CVSS
HIGH
Cross-site Scripting (XSS)
79
CWE
Product Name: N/A
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: No
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2009
BBCode and PHP Cookie Exploit
BBCode of the smf not filtered properly specified urls, allowing attackers to inject malicious JavaScript code. When the user clicks on the image, the malicious JavaScript code is executed. The malicious JavaScript code then calls a PHP script on the attacker's server, which steals the user's cookie and sends it to the attacker.
Mitigation:
Filter user input and escape special characters.
