easy.mask@gmail.com
17/04/06, 19:00
//----- Advisory
Program : BetaBoard
Homepage : http://gonzo.uni-weimar.de/~scheffl2/betaboard/
Tested version : 0.1
Found by : Simon MOREL <philemon at thehackademy dot net>
This advisory : Simon MOREL <philemon at thehackademy dot net>
Discovery date : 2006/04/16
//----- Application description
BetaBoard is a small german forum in which thread list is displayed as an indented tree.
//----- Description of vulnerability
Malicious JavaScript code can be insert in user's profile.
//----- Proof Of Concept
<script>alert('document.cookie')</script>
//----- Impact
Every user reading evil guy's profile can have his cookie stolen
//----- Credits
Simon MOREL <philemon at thehackademy dot net>
http://www.sysdream.com
//----- Greetings
Celelibi for his English ;>
Program : BetaBoard
Homepage : http://gonzo.uni-weimar.de/~scheffl2/betaboard/
Tested version : 0.1
Found by : Simon MOREL <philemon at thehackademy dot net>
This advisory : Simon MOREL <philemon at thehackademy dot net>
Discovery date : 2006/04/16
//----- Application description
BetaBoard is a small german forum in which thread list is displayed as an indented tree.
//----- Description of vulnerability
Malicious JavaScript code can be insert in user's profile.
//----- Proof Of Concept
<script>alert('document.cookie')</script>
//----- Impact
Every user reading evil guy's profile can have his cookie stolen
//----- Credits
Simon MOREL <philemon at thehackademy dot net>
http://www.sysdream.com
//----- Greetings
Celelibi for his English ;>