Xoops 1.3.x/2.0 MyTextSanitizer - HTML Injection

Author: magistrat
type: webapps
platform: php
port: 
date_added: 2003-04-25 
date_updated: 2012-11-07 
verified: 1 
codes: CVE-2003-1453;OSVDB-59320 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/7434/info

A HTML injection vulnerability has been discovered in Xoops. The problem occurs due to insufficient filtering of HTML and script code by the MyTextSanitizer script.

Successful exploitation of this vulnerability may allow a malicious Xoops user to execute arbitrary HTML or script code within the browser of a legitimate user.

java script:alert%28document.cookie%29

The script code must be embedded within HTML <img> tags.