Title: WoltLab Burning Board Lite Form Mail Script Cross-Site Scripting Vulnerability
Severity: MODERATE
Description:
WoltLab Burning Board Lite is a Web-based bulletin board system that is implemented in PHP.
WoltLab Burning Board Lite is prone to a cross-site scripting vulnerability. The cause of the vulnerability is that user-supplied data in the form of HTML and script code is not sufficiently sanitized before being output in dynamically generated Web pages. The specific issue exists in the 'formmail.php' script through the 'userid' URI parameter.
An attacker could exploit this issue by enticing a Web user into following a malicious link that contains hostile HTML and script code. When the link is followed, the HTML and script code will be rendered in the user's browser in the context of the site hosting the software. This may allow for theft of cookie-based authentication credentials or other attacks.
Affected Products:
- Woltlab Burning Board Lite 1.0.0 .0
- Woltlab Burning Board Lite 1.0.1 e
References:
- CityForFree: CityForFree Product Page
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
