header-logo
Suggest Exploit
vendor:
XOOPS
by:
SecurityFocus
8.8
CVSS
HIGH
XOOPS HTML Injection
79
CWE
Product Name: XOOPS
Affected Version From: XOOPS 1.0
Affected Version To: XOOPS 1.0
Patch Exists: YES
Related CWE: CVE-2002-0392
CPE: o:xoops:xoops
Metasploit: https://www.rapid7.com/db/vulnerabilities/apache-httpd-cve-2002-0392/, https://www.rapid7.com/db/vulnerabilities/http-apache2-chunked-transfer-int-bof/, https://www.rapid7.com/db/vulnerabilities/apache-httpd-1_3_x-apache-chunked-encoding-vulnerability-cve-2002-0392/
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: None
2002

Problems with XOOPS could make it possible to execute arbitrary script code in a vulnerable client.

XOOPS is vulnerable to HTML injection attacks due to insufficient filtering of potentially malicious HTML code from posted messages. When a user views a message posting that contains malicious HTML code, the code contained in the message would be executed in the browser of the vulnerable user. This can be exploited to execute arbitrary script code in a vulnerable client's browser.

Mitigation:

Users should avoid viewing untrusted messages and should ensure that all HTML code is properly sanitized before being displayed.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/5785/info

Problems with XOOPS could make it possible to execute arbitrary script code in a vulnerable client.

XOOPS does not sufficiently filter potentially malicious HTML code from posted messages. As a result, when a user views a message posting that contains malicious HTML code, the code contained in the message would be executed in the browser of the vulnerable user. This will occur in the context of the site running the XOOPS software.


<IMG SRC="javascript:[javascript]">

Navigation

Suggest Exploit

Services By CQR