Description
Cross-site scripting (XSS) vulnerability in post.php in AZ Bulletin Board (AZbb) 1.1.00 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) nickname parameter and (2) an iframe tag in the topic parameter. NOTE: the original disclosure specified the name parameter, but a correction was later provided. NOTE: followup posts have both disputed and confirmed the original claim.
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by Roozbeh Afrasiabi · textwebappsphp
https://www.exploit-db.com/exploits/27120
References (10)
Core 10
Core References
Exploit, Vendor Advisory x_refsource_misc
http://kapda.ir/advisory-236.html
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/423353/100/0/threaded
Exploit vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/16351
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/423363/100/0/threaded
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/24274
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/427194/100/0/threaded
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/427076/30/6510/threaded
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/427076/100/0/threaded
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/18565
Third Party Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2006/0298
Scores
EPSS
0.0134
EPSS Percentile
80.1%
Details
Status
published
Products (16)
azbb/az_bulletin_board
1.0.0
azbb/az_bulletin_board
1.0.0rc1
azbb/az_bulletin_board
1.0.0rc2
azbb/az_bulletin_board
1.0.1
azbb/az_bulletin_board
1.0.2
azbb/az_bulletin_board
1.0.3
azbb/az_bulletin_board
1.0.4
azbb/az_bulletin_board
1.0.5
azbb/az_bulletin_board
1.0.6
azbb/az_bulletin_board
1.0.7
... and 6 more
Published
Jan 25, 2006
Tracked Since
Feb 18, 2026