XMB Forum 1.6 pre-beta - Image Tag Script Injection

Author: skizzik
type: webapps
platform: php
port: 
date_added: 2002-02-22
date_updated: 2012-09-12
verified: 1
codes: CVE-2002-0316;OSVDB-8874
tags: 
aliases: 
screenshot_url: 
application_url: 

source: https://www.securityfocus.com/bid/4167/info

The Extreme Message Board (XMB) 1.6 Magic Lantern pre-beta version reportedly allows JavaScript and HTML to be entered in messages. This can be achieved by entering script or HTML between [img] and [/img] tags in a forum message.

This has been fixed in the 1.6 Magic Lantern final beta version of XMB.

[img]javasCript:alert('Hello world.')[/img]