Description
Cross-site scripting (XSS) vulnerability in showprofile.php in Darren's $5 Script Archive osDate 1.1.7 and earlier allows remote attackers to inject arbitrary web script or HTML via the onerror attribute in an HTML IMG tag with a non-existent source file in txtcomment parameter, which is used when posting a comment.
References
- osdate-showprofile-xss(27814) vdb-entry
- ADV-2006-2864 vdb-entry
- 20060812 osDate 1.1.8 - Multiple HTML Injection Vulnerability - fixed mailing-list
- 19034 vdb-entry
- 21103 third-party-advisory
- 1016700 vdb-entry
- 20060719 Re: osDate 1.1.7 multiple vulnerabilities mailing-list
- 20060717 osDate 1.1.7 multiple vulnerabilities mailing-list