Aufmuth Andreas
04/01/08, 16:45
Why don't you just fix it?
The fact, that this field ist not properly sanitised means that u don't =
check all fields by default.
so it may not be an exploitable software bug, but it is a development =
error...=20
-----Urspr=FCngliche Nachricht-----
Von: neothermic@phpbb.com [mailto:neothermic@phpbb.com]=20
Gesendet: Donnerstag, 3. Januar 2008 23:29
An: bugtraq@securityfocus.com
Betreff: Re: phpBB2 2.0.22 Cross Site Scripting Vulnerability
This is why browsers block cross-domain AJAX by default. Added to the =
fact that any action in the ACP requires the SID means that your attack =
via AJAX would fail.
NeoThermic
phpBB Support Team, Audit Team and Incident Investigation Team Leader
The fact, that this field ist not properly sanitised means that u don't =
check all fields by default.
so it may not be an exploitable software bug, but it is a development =
error...=20
-----Urspr=FCngliche Nachricht-----
Von: neothermic@phpbb.com [mailto:neothermic@phpbb.com]=20
Gesendet: Donnerstag, 3. Januar 2008 23:29
An: bugtraq@securityfocus.com
Betreff: Re: phpBB2 2.0.22 Cross Site Scripting Vulnerability
This is why browsers block cross-domain AJAX by default. Added to the =
fact that any action in the ACP requires the SID means that your attack =
via AJAX would fail.
NeoThermic
phpBB Support Team, Audit Team and Incident Investigation Team Leader