bugtraq - Simple Machines Forum Cross-Site Scripting Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 10 Jan 2008 02:12:49 -0000
From: DoZ@...kersCenter.com
To: bugtraq@...urityfocus.com
Subject: Simple Machines Forum Cross-Site Scripting Vulnerabilities

 [HSC] Simple Machines Forum XSS Vulnerabilities

Simple Machines Forum allows attackers to exploiting this vulnerability by cross-site scripting and they will be able to obtain detailed information. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Hackers Center Security Group (http://www.hackerscenter.com)
Credit: Doz

Remote: YES
Class: Improper Validation.

Version: 1.1.4 & Previous!
Vendor: http://www.simplemachines.org

* Attackers can exploit these issues via a web client.

Site.com/component/option,com_smf/Itemid,8'XSS,1/topic,1.0/

Site.com/component/option,com_smf/Itemid,5/topic,1.XSS/

Solution: upgrade to SMF 2.0 1.x when vendor releases to public.

Only becoming a hacker you can stop a hacker. Were can you learn with out having to pay thousands?- http://kit.hackerscenter.com/ - The most comprehensive security pack you will ever find on the net!