Detections
Analytics
YaBB Shadow BBCode Tag XSS
medium Nessus Plugin ID 15859
Language:
Synopsis
The remote web server contains a CGI application that is prone to cross-site scripting attacks.Description
The remote host is using the YaBB web forum software.According to its version number, the remote version of this software is vulnerable to JavaScript injection issues using shadow or glow tags. This may allow an attacker to inject hostile JavaScript into the forum system, to steal cookie credentials or misrepresent site content. When the form is submitted the malicious JavaScript will be incorporated into dynamically-generated content.
Solution
Upgrade to YaBB 1 Gold SP 1.4 or later.See Also
Plugin Details
Severity: Medium
ID: 15859
File Name: yabb_shadow_bbcode_tag.nasl
Version: 1.21
Type: remote
Family: CGI abuses : XSS
Published: 11/30/2004
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Vulnerability Information
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Available: true
Exploit Ease: No exploit is required
Vulnerability Publication Date: 11/25/2004
Reference Information
BID: 11764