Edit Report

Our sensors found this exploit at: http://cxsecurity.com/ascii/WLB-2013030026

Below is a copy:

# Author: Infern0_
# Contact: balut2@o2.pl
# Vendor: http://www.invisionpower.com
# Vulnerability: Persistent XSS
# Vendor informated at: 5 February 2013
# Solution: Disable possibility to use HTML in posts - in administrator panel. Default disabled in v.3.4.2 of IP.B

IP.B v3.4.1 is already a stable version of this software.

To reproduce this issue follow this steps(Obviously you have to be logged in):
1.Go to "My profile settings"
2.Find "Informations about profile" and button "Edit site 'About me'"
3. In that text area paste this code :"<body onload=alert(document.cookie)>"
(DOM based xss, and <script></script> works as well. There isn't any code sanitization,  so you can enter here everything you want to).
Click : "Save".
4. Now go to your profile review(Again choose 'My profile') and here it is - persistent XSS disclosed.

Copyright ©2017 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.