Snitz Forums 2000 3.4.03 - 'search.asp' Cross-Site Scripting

EKU-ID: 28249	CVE: CVE-2003-0492;OSVDB-3297	OSVDB-ID:
Author: JeiAr	Published: 2003-06-16	Verified:
Download:

Rating

☆☆☆☆☆

source: https://www.securityfocus.com/bid/7922/info

Snitz Forums is prone to cross-site scripting attacks. This is due to insufficient sanitization of data passed to the search facility via URI parameters.

Exploitation may allow theft of cookie-based authentication credentials or other attacks.

This issue was reported in Snitz Forums 3.4.0.3, other versions might also be affected.

http://www.example.com/search.asp?Search=">&lt;script&gt;alert()&lt;/script&gt;