XOOPS 2.2.5 - cross-site scripting vulnerability

XOOPS 2.2.5

Risk Level:
MEDIUM - Vulnerability can be exploited to execute arbitrary HTML and script code in a user’s browser session in the context of an affected site.

Cross-site Scripting Vulnerability:
Input passed via the URL to “register.php” in the “/modules/profile” directory isn’t properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.

Sample Exploit Code:

http://host/xoops/modules/profile/register.php?>'"><script>alert('XSS');</script>

The DigiTrust Group