[原文]Cross-site scripting (XSS) vulnerability in search.php in phpBB 2.0.3 and possibly earlier versions allows remote attackers to inject arbitrary web script or HTML via the search_username parameter in searchuser mode.
phpBB is vulnerable to cross site scripting attacks. This is due to insufficient santization of user-supplied input. The problem is located in the search.php script. This issue may be exploited by an attacker to steal a legitimate users cookie-based authentication credentials.
<form method="post" name="search"
<input type="hidden" name="search_username" value=""/>
phpBB contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'search_username' parameter upon submission to the 'search.php' script, when 'mode' is set to 'searchuser'. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.
Currently, there are no known upgrades, patches or workarounds available to correct this vulnerability.