|
Description
|
|
Multiple vulnerabilities have been discovered in bitweaver, which can be exploited by malicious people to conduct cross-site scripting attacks.
1) Input passed via the "username" POST parameter to users/remind_password.php, "days" POST parameter to stats/index.php, and "login" POST parameters to users/register.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
2) Input passed via the "textarea_id" parameter to quicktags/special_chars.php and "email" POST parameter to users/register.php is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
The vulnerabilities are confirmed in version 3.1. Other versions may also be affected.
|
