2.1.9 Beta

A cross site scripting vulnerability has been reported in Ikonboard. Remote users can insert Javascript into bulletin board messages that will be executed when another user views the message.

It is reported that a remote user can place JavaScript between HTML IMG tags to bypass the HTML filtering. When another user views the message, the JavaScript will be executed.

An example of a tag that will bypass the filtering is provided:

<IMG>javascript:alert('This is the test')</img>
A remote user can insert Javascript into bulletin board messages that will be executed by another user's browser when the other user views the message. The code will appear to originate from the bulletin board and may be able to access cookies and other information. This has been fixed in Ikonboard version 3.0.

Reported by Thatsmej <thatsmej@whizkunde.org>.