Description
Cross-site scripting (XSS) vulnerability in inc/functions_post.php in MyBB (aka MyBulletinBoard) 1.0 RC2 through 1.1.4 allows remote attackers to inject arbitrary web script or HTML via a javascript URI with an SGML numeric character reference in the url BBCode tag, as demonstrated using "javascript".
References
- 26808 vdb-entry
- mybb-url-tag-xss(27444) vdb-entry
- 20060628 [KAPDA]MyBB 1.1.4~function_post.php~XSS Attack In URL tag mailing-list
- 18702 vdb-entry
- http://community.mybboard.net/showthread.php?tid=10115
- http://www.mybboard.com/archive.php?nid=15
- http://myimei.com/security/2006-06-22/mybb-114-function_postphpxss-attack-in-url-tag.html
- 1257 third-party-advisory
- 20873 third-party-advisory