Detections
Analytics
paBox pabox.php posticon Parameter XSS
medium Nessus Plugin ID 17336
Language:
Synopsis
The remote web server contains a PHP script that is prone to a cross- site scripting attack.Description
The remote host is running paBox, a web application written in PHP.The remote version of paBox installed on the remote host does not properly sanitize input supplied through the 'posticon' parameter used to select a 'smilie' for a post. By exploiting this flaw, an attacker can inject HTML and script code into the browser of users who view the affected post, potentially stealing authentication cookies and controlling how the affected application is rendered.
Solution
Unknown at this time.See Also
Plugin Details
Severity: Medium
ID: 17336
File Name: pabox_post_icon_xss.nasl
Version: 1.18
Type: remote
Family: CGI abuses : XSS
Published: 3/16/2005
Updated: 1/19/2021
Supported Sensors: Nessus
Vulnerability Information
Required KB Items: www/PHP
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Available: true
Exploit Ease: No exploit is required
Vulnerability Publication Date: 3/14/2005
Reference Information
BID: 12796