CVE-2006-1204 Information

Description

Multiple cross-site scripting (XSS) vulnerabilities in txtForum 1.0.4-dev and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) prev (2) next and (3) rand5 parameters in (a) index.php; the (4) r_username and (5) r_loc parameters in (b) new_topic.php; the (6) r_num (7) r_family_name (8) r_icq (9) r_yahoo (10) r_aim (11) r_homepage (12) r_interests (13) r_about (14) selected1 (15) selected0 (16) signature_selected1 (17) signature_selected0 (18) smile_selected1 (19) smile_selected0 (20) ubb_selected1 and (21) ubb_selected0 parameters in (c) profile.php; the (22) quote and (23) tid parameters in (d) reply.php; and the (24) tid (25) sticked and (26) mid parameters in (e) view_topic.php.

Reference

http://www.osvdb.org/23953 http://www.osvdb.org/23954 http://www.osvdb.org/23955 http://www.osvdb.org/23956 http://www.osvdb.org/23957 http://www.seclab.tuwien.ac.at/advisories/TUVSA-0603-003.txt http://www.securityfocus.com/archive/1/427186/100/0/threaded http://www.securityfocus.com/bid/17054 https://exchange.xforce.ibmcloud.com/vulnerabilities/25132