url BBCode XSS in slickMsg
Summary
- Vulnerability
- url BBCode XSS in slickMsg
- Discovered
- 2010.12.01
- Last Update
- n/a n/a
- ID
- EV0160
- CVE
- n/a
- Risk Level
- low
- Type
- Cross Site Scripting
- Status
- Unpatched. Vendor notified. No reply from developer(s).
- Vendor
- n/a
- Vulnerable Software
- slickMsg (http://slickmsg.sourceforge.net/)
- Version
- 0.7-alpha
- PoC/Exploit
- Available
- Solution
- Not available
- Discovered by
- Aliaksandr Hartsuyeu (eVuln.com)
Description
Cross Site Scripting found in slickMsg (http://slickmsg.sourceforge.net/) script.
- XSS in 'url' BBcode
- It is possible to inject XSS code into link bbcode.
"url" value is not properly sanitized before being used in HTML code.
Condition: click on link is required.
PoC/Exploit
url BBcode XSS example.
XSS example: [url=javascript:alert(123)]bbcode xss test[/url]
Solution.
Solution for "url BBCode XSS in slickMsg" is not available. Check vendor's website for updates.
Order Source Code Testing
Protect your site by source code audit of your website made by Aliaksandr Hartsuyeu.The task will be done by experts in web application security.