CVE-2004-0322
published 2004-02-23CVE-2004-0322: Multiple cross-site scripting (XSS) vulnerabilities in XMB 1.8 Final SP2 allow remote attackers to execute arbitrary script as other users via the (1) member…
PriorityP421medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EXPLOIT
EPSS
4.86%
90.9th percentile
Multiple cross-site scripting (XSS) vulnerabilities in XMB 1.8 Final SP2 allow remote attackers to execute arbitrary script as other users via the (1) member parameter in member.php, (2) uid parameter in u2uadmin.php, (3) user parameter in editprofile.php, (4) an onmouseover event in an align tag when bbcode is allowed, or (5) img tag where bbcode is allowed.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| xmb_forum | xmb | — | — |
| xmb_forum | xmb | — | — |
| xmb_forum | xmb | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
XMB Forum 1.8 - 'u2uadmin.php?uid' Cross-Site Scripting
exploitdb·2004-02-23
CVE-2004-0322 XMB Forum 1.8 - 'u2uadmin.php?uid' Cross-Site Scripting
XMB Forum 1.8 - 'u2uadmin.php?uid' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/9726/info
XMB Forum has been reported prone to multiple cross-site scripting, HTML injection and SQL injection vulnerabilities. The issues present themselves due to insufficient sanitization of remote user supplied data. An attacker may exploit any one of these vulnerabilities to execute arbitrary script code in the browser of an unsuspecting user or to have malicious SQL queries executed in the underlying database.
http://www.example.com/xmb18sp2/u2uadmin.php?uid=x">alert(document.cookie);
Exploit-DB
XMB Forum 1.8 - BBcode align Tag Cross-Site Scripting
exploitdb·2004-02-23
CVE-2004-0322 XMB Forum 1.8 - BBcode align Tag Cross-Site Scripting
XMB Forum 1.8 - BBcode align Tag Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/9726/info
XMB Forum has been reported prone to multiple cross-site scripting, HTML injection and SQL injection vulnerabilities. The issues present themselves due to insufficient sanitization of remote user supplied data. An attacker may exploit any one of these vulnerabilities to execute arbitrary script code in the browser of an unsuspecting user or to have malicious SQL queries executed in the underlying database.
text1 [align=center onmouseover=alert(document.cookie);] text2 [/align]
Exploit-DB
XMB Forum 1.8 - 'editprofile.php?user' Cross-Site Scripting
exploitdb·2004-02-23
CVE-2004-0322 XMB Forum 1.8 - 'editprofile.php?user' Cross-Site Scripting
XMB Forum 1.8 - 'editprofile.php?user' Cross-Site Scripting
---
source: https://www.securityfocus.com/bid/9726/info
XMB Forum has been reported prone to multiple cross-site scripting, HTML injection and SQL injection vulnerabilities. The issues present themselves due to insufficient sanitization of remote user supplied data. An attacker may exploit any one of these vulnerabilities to execute arbitrary script code in the browser of an unsuspecting user or to have malicious SQL queries executed in the underlying database.
http://www.example.com/xmb18sp2/editprofile.php?user=x">alert(document.cookie);
No writeups or analysis indexed.
http://archives.neohapsis.com/archives/bugtraq/2004-02/0645.htmlhttp://marc.info/?l=bugtraq&m=107756526625179&w=2http://www.securityfocus.com/bid/9726http://www.xmbforum.com/community/boards/viewthread.php?tid=746859https://docs.xmbforum2.com/index.php?title=Security_Issue_Historyhttps://exchange.xforce.ibmcloud.com/vulnerabilities/15292https://exchange.xforce.ibmcloud.com/vulnerabilities/15294http://archives.neohapsis.com/archives/bugtraq/2004-02/0645.htmlhttp://marc.info/?l=bugtraq&m=107756526625179&w=2http://www.securityfocus.com/bid/9726http://www.xmbforum.com/community/boards/viewthread.php?tid=746859https://docs.xmbforum2.com/index.php?title=Security_Issue_Historyhttps://exchange.xforce.ibmcloud.com/vulnerabilities/15292https://exchange.xforce.ibmcloud.com/vulnerabilities/15294
2004-02-23
Published