# Author: Infern0_ # Contact: firstname.lastname@example.org # Vendor: http://www.invisionpower.com # Vulnerability: Persistent XSS # Vendor informated at: 5 February 2013 # Solution: Disable possibility to use HTML in posts - in administrator panel. Default disabled in v.3.4.2 of IP.B IP.B v3.4.1 is already a stable version of this software. To reproduce this issue follow this steps(Obviously you have to be logged in): 1.Go to "My profile settings" 2.Find "Informations about profile" and button "Edit site 'About me'" 3. In that text area paste this code :"<body onload=alert(document.cookie)>" (DOM based xss, and <script></script> works as well. There isn't any code sanitization, so you can enter here everything you want to). Click : "Save". 4. Now go to your profile review(Again choose 'My profile') and here it is - persistent XSS disclosed.
Copyright ©2017 Exploitalert.