DCForum+ 1.2 – ‘Subject’ HTML Injection

DCForum+ 1.2 – ‘Subject’ HTML Injection

漏洞ID 1054088 漏洞类型
发布时间 2003-08-11 更新时间 2003-08-11
图片[1]-DCForum+ 1.2 – ‘Subject’ HTML Injection-安全小百科CVE编号 N/A
图片[2]-DCForum+ 1.2 – ‘Subject’ HTML Injection-安全小百科CNNVD-ID N/A
漏洞平台 PHP CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/23008
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/8384/info

DCForum+ is prone to an HTML injection vulnerability. An attacker may exploit this issue by including hostile HTML and script code in the subject field of posts to the bulletin board. This is because the script that processes posts does not sufficiently sanitize user input, allowing attackers to embed HTML and script commands within the post. This code may be rendered in the web browser of a user who views these areas of the site. This would occur in the security context of the site hosting DCForum+.

Your Name: Zone-h Security Team
Your Email: [email protected]
Your Subject: <script>alert(Zone-h)</script>
Your Message: Zone-h.org

相关推荐: Aladdin eSafe Gateway过滤绕过漏洞

Aladdin eSafe Gateway过滤绕过漏洞 漏洞ID 1106361 漏洞类型 未知 发布时间 2001-05-29 更新时间 2001-08-14 CVE编号 CVE-2001-0519 CNNVD-ID CNNVD-200108-057 漏洞平…

© 版权声明
THE END
喜欢就支持一下吧
点赞0
分享