PT-2004-2761 · Extreme · Extreme Messageboard

Janek Vind + 1 · Published 2004-03-26 · Updated 2021-04-29 · CVE-2004-1862

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Extreme Messageboard (XMB) versions 1.8 SP3 through 1.9 beta

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved via several parameters in different scripts, including the xmbuser parameter to "xmb.php", the folder parameter to "u2u.php", the viewmost, replymost, or latest parameter to "stats.php", the message or icons parameter to "post.php", and the threadlist, pagelinks, forumlist, navigation, or forumdisplay parameter to "forumdisplay.php".

Recommendations For Extreme Messageboard (XMB) versions 1.8 SP3 through 1.9 beta, consider disabling the vulnerable parameters until a patch is available. Specifically, restrict access to the xmbuser parameter in "xmb.php", the folder parameter in "u2u.php", the viewmost, replymost, and latest parameters in "stats.php", the message and icons parameters in "post.php", and the threadlist, pagelinks, forumlist, navigation, and forumdisplay parameters in "forumdisplay.php" to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2004-1862

Affected Products

Extreme Messageboard

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2004-1862 · Security Note
• http://securityfocus.com/bid/9983 · Vendor Advisory
• http://osvdb.org/14983 · Note
• http://osvdb.org/14986 · Note
• http://osvdb.org/14987 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15654 · Note
• http://marc.info/?l=bugtraq&m=108032355905265&w=2 · Note
• http://secunia.com/advisories/11230 · Note
• http://osvdb.org/14985 · Note
• https://docs.xmbforum2.com/index.php?title=Security_Issue_History · Note
• http://osvdb.org/14988 · Note