Description
Multiple cross-site scripting (XSS) vulnerabilities in PhpBB 2.0.8 allow remote attackers to inject arbitrary web script or HTML via (1) the cat_title parameter in index.php, (2) the faq[0][0] parameter in lang_faq.php as accessible from faq.php, or (3) the faq[0][0] parameter in lang_bbcode.php as accessible from faq.php.
References
- phpbb-lang-faq-xss(16725) vdb-entry
- 20040716 [waraxe-2004-SA#034 - XSS and path full path disclosure in PhpBB 2.0.8] mailing-list
- 10738 vdb-entry
- http://www.waraxe.us/index.php?modname=sa&id=34
- phpbb-lang-bbcode-xss(16726) vdb-entry
- phpbb-indexphp-xss(16724) vdb-entry