Kusaba X & amp; lt; = 0.9.1 multiple defects and repair

######################################## ###############

# KusabaX XSS and CSRF Vulnerabilites #

######################################## ###############

# Product: KusabaX and various Futaba channels clone

# Vendor site: http://kusabax.cultnet.net/

# Affected versions: KusabaX <= 0.9.1

# Product description: an imageboard is a web application written in PHP used in sites

# Like 4 chan as an anonymous bullettin board based on image sharing.

# Author: Emilio Pinna-ncl 01 _ at _ email _ dot _ it

# Blog site: http://thissecting.wordpress.com

# Date: 27/04/2011

######################################## ###############

# Cross Site Scripting in animation. php #

######################################## ###############

# Vulnerable page: animation. php

# Google dork: allinurl: animation. php board id

File "animation. php" suffer from XSS vulnerabilities in line 47:

#-----------------------------------------------------#

<Param name = "pch_file" value = "<? Php echo KU_BOARDSPATH./. $ _ GET [board]./src/. $ _ GET [id].. pch;?> ">

#-----------------------------------------------------#

Attackers can exploit these weaknesses to execute arbitrary HTML and script code

In a users browser session that visit resulting in a cookie stealing and bypass of admin

Access controls.

#-----------------------------------------------------#