Re: [Full-disclosure] Invision Iframe Bug

[Paul Laudanski <zx@xxxxxxxxxxxxxx>]

On Thu, 24 Mar 2005, Woody wrote:

> Hi,
> 
> I've found a bug in Invision Board, it let's you send private messages
> around, change people their signature, avatar, etc.
> 
> If the administrator doesn't filter all the html tags on a forum (or just
> forgets, which is often the case) you can add an invisible iframe to your
> post. Now if you just figure out how invision board sends for example a
> private message, you can let people send one to someone.

Just out of curiosity, which version of the software did you test this on, 
and which if any are immune?

-- 
Sincerely,

Paul Laudanski .. Computer Cops, LLC.
CastleCops(SM)... http://castlecops.com
CC Blog ......... http://blog.castlecops.com
Staff Blogs ..... http://busterbunny.castlecops.com
Our Vision ...... http://castlecops.com/postt63382.html

http://cuddlesnkisses.com http://justalittlepoke.com http://zhen-xjell.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/