Mibew · Mibew Messenger · CVE-2012-0829
**Name of the Vulnerable Software and Affected Versions**
Mibew Messenger versions 1.6.4 and earlier
**Description**
The issue allows remote attackers to hijack the authentication of operators for requests that insert cross-site scripting (XSS) sequences. This can be achieved via the `address` or `threadid` parameters to "operator/ban.php", or the `geolinkparams`, `title`, or `chattitle` parameters to "operator/settings.php".
**Recommendations**
For Mibew Messenger versions 1.6.4 and earlier, consider disabling access to the "operator/ban.php" and "operator/settings.php" endpoints until a patch is available. Restrict the use of the `address`, `threadid`, `geolinkparams`, `title`, and `chattitle` parameters in these endpoints to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.