Secunia

Cheng Peng Su has reported a vulnerability in YaBB and YaBB SE, allowing malicious people to conduct cross-site scripting attacks.

The problem is that input passed to the "glow" and "shadow" tags isn't filtered properly. This can be exploited by posting malicious messages with script code embedded in the tags. The script code will be executed when messages are read.

Example:
[glow=red);background:url(javascript:script_code);filter:glow(color=red,2,300]Text[/glow]

The vulnerability has been reported in YaBB 1 Gold(SP1.3) and YaBB SE 1.5.1 Final. Other versions may also be affected.

Solution
Update to YaBB 1 GOLD SP 1.3.2.
Further details available in Customer Area

Provided and/or discovered by
Cheng Peng Su

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area