https://www.exploit-db.com/exploits/24692

漏洞细节尚未披露

source: http://www.securityfocus.com/bid/11463/info

It is reported that Jebuch is susceptible to an HTML injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input.

This may allow an attacker to inject malicious HTML and script code into the application. An unsuspecting user viewing a page that contains the malicious embedded code will have the attacker-supplied script executed within their browser in the context of the vulnerable site. This issue may be leveraged to steal cookie based authentication credentials. Other attacks are also possible.

Version 1.0 of Jebuch is reported vulnerable to this issue.

[img]"?" onError="window.location='http://www.example.com'"[/img]