I don't have access to many blackboard systems but I can confirm that in Blackboard Learning System version 8 (8.0.375.0) and Blackboard Learning System - CE Enterprise License (Release CE 8.0.4) that CVE-2006-4308 was not actually fixed.
Any user with access to forums, assignment submission(comments / submission) which allows for html input is open to xss and open redirect. Blackboard does filter the <script> tag (and use of other tags) but you can use <meta>(refresh) and the following xss example *should* work. <input type="text" AUTOFOCUS onfocus=alert(1)> I do not have access to a blackboard 9 system, but I suspect this will not work as the interface has been redone from the screen-shots I have seen. -- He draweth out the thread of his verbosity finer than the staple of hisargument. -- William Shakespeare, "Love's Labour's Lost" _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
