phpWebSite 0.8.3 - News Message HTML Injection

Author: das@hush.com
type: webapps
platform: php
port: nan
date_added: 2002-09-25 
date_updated: 2012-10-09 
verified: 1 
codes: CVE-2002-2178;OSVDB-3850 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/5802/info

Problems with phpWebSite could make it possible to execute arbitrary script code in a vulnerable client.

phpWebSite does not sufficiently filter potentially malicious HTML code from news posts. As a result, when a user views a news posting that contains malicious HTML code, the code contained in the posted message would be executed in the browser of the vulnerable user. This will occur in the context of the site running the phpWebSite software.

<IMG SRC="javascript:alert('unsecure')">