vendor:
Xoops BBCode
by:
SecurityFocus
7.5
CVSS
HIGH
HTML Injection
79
CWE
Product Name: Xoops BBCode
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2002
Xoops BBCode HTML Injection Vulnerability
Xoops BBCode has been reported prone to an HTML injection vulnerability. It has been reported that an attacker may inject malicious script into areas of Xoops where BBCode is rendered. This issue is due to a lack of sufficient sanitization performed on user supplied BBCode tags. Injected code may be rendered in the web browser of a user who views vulnerable areas of the site. This would occur in the security context of the site hosting Xoops and its related modules.
Mitigation:
Input validation should be used to ensure that user supplied BBCode tags are properly sanitized.
