Iron has reported a vulnerability in Invision Power Board, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed to the "editorid" parameter in jscripts/folder_rte_files/module_table.php is not properly sanitised before it is returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

NOTE: Other files are reportedly also affected.

The vulnerability is reported in version 2.2.2 and earlier 2.2.x versions. Other versions may also be affected.

Solution
Install the vendor's official fix:
Further details available to Secunia VIM customers

Provided and/or discovered by
Iron

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://forums.invisionpower.com/index.php?showtopic=235069

Deep Links
Links available to Secunia VIM customers