PT-2002-1204 · Infopop · Infopop Ultimate Bulletin Board

Published 2002-03-15 · Updated 2008-11-04 · CVE-2002-0118

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Infopop Ultimate Bulletin Board (UBB) version 6.2.0 Beta Release 1.0

Description The issue allows remote attackers to execute arbitrary script and steal cookies via a message containing encoded Javascript in an IMG tag.

Recommendations For Infopop Ultimate Bulletin Board (UBB) version 6.2.0 Beta Release 1.0, consider disabling the ability to post messages containing IMG tags until a patch is available. Restrict access to sensitive areas of the board to minimize the risk of exploitation. Avoid allowing users to post encoded Javascript in messages. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2002-0118

Affected Products

Infopop Ultimate Bulletin Board

References · 5

• 🔥 https://exploit-db.com/exploits/21209 · Exploit
• 🔥 http://online.securityfocus.com/archive/1/249031 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-0118 · Security Note
• http://iss.net/security_center/static/7838.php · Vendor Advisory
• http://securityfocus.com/bid/3829 · Note