Description
Multiple cross-site request forgery (CSRF) vulnerabilities in Mibew Messenger 1.6.4 and earlier allow remote attackers to hijack the authentication of operators for requests that insert cross-site scripting (XSS) sequences via the (1) address or (2) threadid parameters to operator/ban.php; or (3) geolinkparams, (4) title, or (5) chattitle parameters to operator/settings.php.
References
- mibew-webinterface-csrf(72822) vdb-entry
- 47787 third-party-advisory
- 51723 vdb-entry
- 20120130 Mibew messenger multiple XSS mailing-list
- [oss-security] 20120202 Re: XSS hiding CSRF (was: Re: Mibew messenger multiple XSS) mailing-list
- http://www.codseq.it/advisories/mibew_messenger_multiple_xss