I just saw this thread on another forum.

There are two XSS flaws in the latest miniBB 2.2

Cookie changing (Use a cookie editor): miniBBsite=>"><ScRiPt %0A%0D>alert(402967245059)%3B</ScRiPt>


XSS[2]: index.php?action=search&step=>"><ScRiPt %0A%0D>alert(XSStexthere)%3B</ScRiPt>&userto=USERIDHERE

Are these possible and if so, whats the fix?

It would good if you provide URL to that forum. I don't understand what this means and what effect it could have.

http://h4cky0u.org/viewtopic.php?f=2&t=30205

thats where I saw it. you need to register to view that post

Right now I've got reply from the hack's author. I will do a conversation with him and post results later. By now I truly don't see what's the sense of these "hacks".

I hope it's fixed in 2.2b now (though the issue with cookie is under deep doubt); and the first one related to a Captcha module only.