medium4.3Public exploit code
CVE-2004-0322
Multiple cross-site scripting (XSS) vulnerabilities in XMB 1.8 Final SP2 allow remote attackers to execute arbitrary script as other users via the (1) member p…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- XMB Forum 1.8 - BBcode align Tag Cross-Site Scripting2004-02-23 · webapps · php · Verified
- XMB Forum 1.8 - 'editprofile.php?user' Cross-Site Scripting2004-02-23 · webapps · php · Verified
- XMB Forum 1.8 - 'u2uadmin.php?uid' Cross-Site Scripting2004-02-23 · webapps · php · Verified
Impact
Multiple cross-site scripting (XSS) vulnerabilities in XMB 1.8 Final SP2 allow remote attackers to execute arbitrary script as other users via the (1) member parameter in member.php, (2) uid parameter in u2uadmin.php, (3) user parameter in editprofile.php, (4) an onmouseover event in an align tag when bbcode is allowed, or (5) img tag where bbcode is allowed.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Xmb Forum | Xmb | Versions 1.8, 1.8_sp1, 1.8_sp2 |
References
- NVD record
- CVE.org record
- http://archives.neohapsis.com/archives/bugtraq/2004-02/0645.html
- http://marc.info/?l=bugtraq&m=107756526625179&w=2
- http://www.securityfocus.com/bid/9726
- http://www.xmbforum.com/community/boards/viewthread.php?tid=746859
- https://docs.xmbforum2.com/index.php?title=Security_Issue_History
- https://exchange.xforce.ibmcloud.com/vulnerabilities/15292
- https://exchange.xforce.ibmcloud.com/vulnerabilities/15294
- http://archives.neohapsis.com/archives/bugtraq/2004-02/0645.html
- http://marc.info/?l=bugtraq&m=107756526625179&w=2
- http://www.securityfocus.com/bid/9726
- http://www.xmbforum.com/community/boards/viewthread.php?tid=746859
- https://docs.xmbforum2.com/index.php?title=Security_Issue_History
- https://exchange.xforce.ibmcloud.com/vulnerabilities/15292
- https://exchange.xforce.ibmcloud.com/vulnerabilities/15294