XMB Forum 1.6 Magic Lantern Cross-Site Scripting Vulnerabilities

vendor:

XMB Forum 1.6 Magic Lantern

by:

SecurityFocus

4.3

CVSS

MEDIUM

Cross-Site Scripting

CWE

Product Name: XMB Forum 1.6 Magic Lantern

Affected Version From: 1.6

Affected Version To: 1.6

Patch Exists: YES

Related CWE: N/A

CPE: a:xmb_forum:xmb_forum:1.6

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2002

XMB Forum 1.6 Magic Lantern Cross-Site Scripting Vulnerabilities

XMB Forum 1.6 Magic Lantern is vulnerable to a number of cross-site scripting issues because of improper filtering of user input. The first involves 'member.php'; submitting script to the variable 'member' in the context of 'action=viewpro' (profile viewing) will cause that script to be returned as an error message. The second involves the 'MSN' information field of a user profile; a registered user can submit script to this field without it being filtered. The third issue can be exploited by submitting a '<script>' tag encoded as '%253Cscript%253E' (note that the percent sign is encoded as '%25', and '3C' and '3E' are the '<' and '>' brackets) to the username variable in the context of 'action=reg' to 'member.php'.

Mitigation:

Input validation should be used to ensure that user-supplied data is properly filtered and sanitized.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/4721/info

XMB Forum 1.6 Magic Lantern is a web-based discussion forum. It is vulnerable to a number of cross-site scripting issues because of improper filtering of user input.

1. The first involves 'member.php'; submitting script to the variable 'member' in the context of 'action=viewpro' (profile viewing) will cause that script to be returned as an error message.

2. The second involves the 'MSN' information field of a user profile; a registered user can submit script to this field without it being filtered.

3. The third issue can be exploited by submitting a '<script>' tag encoded as '%253Cscript%253E' (note that the percent sign is encoded as '%25', and '3C' and '3E' are the '<' and '>' brackets) to the username variable in the context of 'action=reg' to 'member.php'. 

member.php?action=viewpro&member=<form%20name=o><input%20name=u%20value=XSS></form><script>alert(document.o.u.value)</script>

member.php?action=reg&username=%253Cscript%253E&... .