CVE-2002-0959

Vulnerability

Splatt Forum version 3.0 is vulnerable to a cross-site scripting (XSS) flaw. The application does not properly filter HTML within image tags, allowing remote attackers to inject arbitrary script code into forum messages. This vulnerability is present in the handling of [img] tags [1].

Exploitation

An attacker can exploit this vulnerability by crafting a forum message containing a malicious [img] tag. This tag must include a closing quote followed by JavaScript code, such as [img]http://a.a/a"onerror="javascript:alert(document.cookie)[/img]. When another user views this message, the injected script will execute in their browser [1].

Impact

Successful exploitation allows an attacker to execute arbitrary script code in the context of the victim user's browser. This can lead to the hijacking of web content or the theft of cookie-based authentication credentials from legitimate users [1].

Mitigation

No specific patched version or release date is mentioned in the available references. Users are advised to check for updates from the vendor or consider alternative solutions. The vulnerability is listed on Exploit-DB [1].