CSS in phpBB 1.4.4

[SandI]]

I found a bug in quite old forum system phpBB 1.4.4

phpBB 1.4.4 is vulnerable to Cross Site Scripting Attack.

[Vulnerable]

You can put vbscript in [img] bbcode tags.
For example:

[img]vbscript: alert(document.cookie)[/img]

Author: Gurjanov Ilia or Net
agent050@sama.ru

[Paul Owen]

> phpBB 1.4.4 is vulnerable to Cross Site Scripting Attack.
>=20
> [Vulnerable]
>=20
> You can put vbscript in [img] bbcode tags.
> For example:
>=20
> [img]vbscript: alert(document.cookie)[/img]

phpBB 1.x hasn't been supported for over two years. All users of phpBB
1.x have been long advised to switch to phpBB 2.x or other system (as
they see fit).

psoTFX - phpbb.com