MiniBB 1.2 Cross-Site Scripting Vulnerability

Gerardo Vazquez, Eduardo Arriols 17.04.2002 Verified
Web Application Exploits PHP

Exploit Code

source: http://www.securityfocus.com/bid/4619/info

MiniBB is web forum software. It is written in PHP and will run on most Unix and Linux variants as well as Microsoft Windows operating systems.

MiniBB does not filter script code from URL parameters, making it prone to cross-site scripting attacks.

This may enable a remote attacker to steal cookie-based authentication credentials from legitimate users of a website running MiniBB. 

http://target/forums/index.php?action=search&searchFor="><script>alert("test")</script >