The version of Burning Board or Burning Board Lite installed on the remote host may be prone to cross-site scripting attacks due to its failure to properly sanitize input passed to the 'folderid' parameter of the 'pms.php' script.  An attacker may be able to exploit this flaw to cause arbitrary HTML and script code to be run in a user's browser within the context of the affected website.

遠端主機上安裝的 Burning Board 或 Burning Board Lite 版本由於無法正確清理傳遞至「pms.php」指令碼中「folderid」參數的輸入，因而可能容易遭受跨網站指令碼攻擊。攻擊者可以利用此缺陷，於使用者的瀏覽器中在受影響網站的內容中執行任意 HTML 和指令碼。

リモートホストにインストールされているバージョンのBurning BoardまたはBurning Board Liteは、「pms.php」スクリプトの「folderid」パラメーターに渡された入力を適切にサニタイズできないため、クロスサイトスクリプティング攻撃に脆弱な場合があります。攻撃者がこの欠陥を悪用して、影響を受けるWebサイトのコンテキスト内のユーザーのブラウザで任意のHTMLおよびスクリプトコードを実行させる可能性があります。

远程主机上安装的 Burning Board 或 Burning Board Lite 版本可能容易遭受跨站脚本攻击，这是其无法正确审查传递到“pms.php”脚本的“folderid”参数的输入所致。攻击者可能会利用此缺陷，导致任意 HTML 和脚本代码在受影响网站环境的用户浏览器中运行。

The remote host is running Woltlab Burning Board, a web bulletin board written in PHP.  This version of Burning Board is vulnerable to a remote Cross-Site Scripting (XSS) attack.  An attacker exploiting this flaw would typically need to convince a user to browse to a malicious URI.  Success exploitation would result in the theft of confidential materials (such as authentication cookies).

This version of Woltlab is also vulnerable to a remote SQL injection
attack.  An attacker exploiting this flaw would send a malformed
'email' form query to the 'verify_email()' function.  Succesful exploitation
would result in the attacker being able to read or write confidential
data.  In some instances, the attacker may be able to execute arbitrary
code on the remote database server.

ID	名稱	產品	系列	已發布	已更新	嚴重性
18251	Woltlab Burning Board pms.php folderid Parameter XSS	Nessus	CGI abuses : XSS	2005/5/12	2022/6/1	medium
18251	Woltlab Burning Board pms.phpfolderid 參數 XSS	Nessus	CGI abuses : XSS	2005/5/12	2022/6/1	medium
18251	Woltlab Burning Board pms.phpのfolderidパラメーターのXSS	Nessus	CGI abuses : XSS	2005/5/12	2022/6/1	medium
18251	Woltlab Burning Board pms.php folderid 参数 XSS	Nessus	CGI abuses : XSS	2005/5/12	2022/6/1	medium
2848	Woltlab Burning Board XSS / SQL Injection Vulnerabilities	Nessus Network Monitor	CGI	2005/4/22	2019/3/6	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium