[Ivan]

SMF "Index.php?action=PM" Cross-Site Scripting

#Explanation:
#
#-First of all user must be REGISTERED
#-Go to http://target/smf/index.php?action=pm;sa=send
#-Inster your xss code for the recipient or BCC
#-Press send.

Quikfix for ver 1.1.1

File: PersonalMessage.php
Change 1417 and 1418 lines adding htmlspecialchars();

PHP kôd:

$_REQUEST['to'] = empty($_POST['to']) ? (empty($_GET['to']) ? '' : $_GET['to']) : htmlspecialchars(stripslashes($_POST['to']));
$_REQUEST['bcc'] = empty($_POST['bcc']) ? (empty($_GET['bcc']) ? '' : $_GET['bcc']) : htmlspecialchars(stripslashes($_POST['bcc']));