COMMAND

	XMB cross-scripting vulnerability

SYSTEMS AFFECTED

	 All versions of XMB board, including  last version -

	 XMB 1.6x Magic Lantern

	

PROBLEM

	SliderGod posted :
	

	XMB is a php-based forum. This product contain a  Cross  Site  Scripting
	vulnerability that allows  attackers  to  insert  JavaScript  code  (and
	other  HTML  code)  into  existing  messages,  bypassing  the   internal
	JavaScript/HTML code stripper.
	

	 Exploit :

	 =======

	

	[img]javasCript:alert(\'Hello world.\')[/img]

	

SOLUTION

	Searching the image URL for the text \"javascript:\"  should  solve  the
	problem