Vulnerability found:
13 May 2003
Credits:
ProCheckUp Labs
Description:
Phorum is prone to HTML injection attacks. HTML and script code may be echoed back when an existing user is specified from the registration page. This could potentially permit a malicious attacker to cause the execution of hostile HTML and script code in the web client of a user who visits a vulnerable site hosting Phorum.
How to fix:
Solution:
This vulnerability does not affect Phorum 3.4.3. Users are advised to upgrade:
Phorum Phorum 3.4
• Phorum phorum-3.4.3.tar.gz
http://phorum.org/downloads/phorum-3.4.3.tar.gz
Phorum Phorum 3.4.1
• Phorum phorum-3.4.3.tar.gz
http://phorum.org/downloads/phorum-3.4.3.tar.gz
Phorum Phorum 3.4.2
• Phorum phorum-3.4.3.tar.gz
http://phorum.org/downloads/phorum-3.4.3.tar.gz
References:
•Phorum Homepage (Phorum)
•Phorum Vulnerabilities ()
Legal:
Copyright 2003 ProCheckUp Ltd. All rights reserved.
Permission is granted for copying and circulating this Bulletin to the Internet community for the purpose of alerting them to problems, if and only if, the Bulletin is not edited or changed in any way, is attributed to Procheckup, and provided such reproduction and/or distribution is performed for non-commercial purposes.
Any other use of this information is prohibited. Procheckup is not liable for any misuse of this information by any third party.
Categories