Invision Power Board Attachments Cross Site Scripting Issue

[TJ]

* Technical Description *

A cross site scripting vulnerability was identified in Invision Power Board, which may be exploited by attackers to inject malicious HTML code. This flaw is due to a design error when processing uploaded HTML and TEXT attachments, which may be exploited by attackers to cause arbitrary scripting code to be executed by the user's browser when specially crafted attachments are viewed.

 * Affected Products *

Invision Power Board version 2.0.4 and prior
Invision Power Board version 1.0.3 and prior

 * Solution *

No official supplied patch for this issue.

 * References *

http://www.frsirt.com/english/advisories/2005/1347