Re: XSS phpBB 2.0.21 in administration

["Jessica Hope" <jessicasaulhope@xxxxxxxxxxxxxx>]

I know what XSS is. I'm pointing out the fact that to do any of the
XSS items in the report given, you have to be admin (since they are
all in the admin panel). If you are in the admin panel of any forum,
then there's other things you can do than try fiddle about with XSS.

Jessica


On 7/19/06, David Thomson <dave@xxxxxxxxxxxxxxxx> wrote:
> Defenition from Google, on XSS.
>
> Cross site scripting (XSS) is a type of computer security exploit where
> information from one context, where it is not trusted, can be inserted into
> another context, where it is. From the trusted context, an attack can be
> launched. Note that although cross site scripting is also sometimes
> abbreviated "CSS", it has nothing to do with the Cascading Style Sheets
> technology that is more commonly called CSS.
>
> Example:
>
> A XSS attack is something that an attacker performs, not an admin. You can
> use XSS to retrieve session information, cookies, md5 hashs, password hashes
> all from within a web browser, no need to be an admin.
>
> Hope this helps.