Secunia

Some vulnerabilities have been reported in LedForums, which can be exploited by malicious users to conduct Cross-Site Scripting attacks.

The vulnerabilities are caused due to missing validation of input supplied to the "top_message" parameter in "index.php" and in topic names. This can be exploited by including arbitrary HTML or script code in the parameter or as a topic name, which will cause it to be executed in a user's browser session when viewed.

Example:
http://[victim]/[path]/index.php?top_message=<script>alert(document.cookie)</script>

The vulnerabilities have been reported in LedForums Beta 1.

Solution
Filter malicious input in a HTTP proxy or firewall with URL filtering capabilities.

Provided and/or discovered by
ProXy

Deep Links
Links available in Customer Area