Snitz Forums 2000 3.4.03 - 'search.asp' Cross-Site Scripting

Author: JeiAr
type: webapps
platform: asp
port: 
date_added: 2003-06-16 
date_updated: 2012-11-17 
verified: 1 
codes: CVE-2003-0492;OSVDB-3297 
tags: 
aliases:  
screenshot_url:  
application_url:

source: https://www.securityfocus.com/bid/7922/info

Snitz Forums is prone to cross-site scripting attacks. This is due to insufficient sanitization of data passed to the search facility via URI parameters.

Exploitation may allow theft of cookie-based authentication credentials or other attacks.

This issue was reported in Snitz Forums 3.4.0.3, other versions might also be affected.

http://www.example.com/search.asp?Search=">&lt;script&gt;alert()&lt;/script&gt;