Phorum Register.PHP Cross-Site Scripting Vulnerability
BID:14726
Info
Phorum Register.PHP Cross-Site Scripting Vulnerability
| Bugtraq ID: | 14726 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 02 2005 12:00AM |
| Updated: | Sep 02 2005 12:00AM |
| Credit: | Scott Dewey is credited with the discovery of this vulnerability. |
| Vulnerable: |
Phorum Phorum 5.0.17 a Phorum Phorum 5.0.16 Phorum Phorum 5.0.14 Phorum Phorum 5.0.13 Phorum Phorum 5.0.12 Phorum Phorum 5.0.11 Phorum Phorum 5.0.10 Phorum Phorum 5.0.15a Phorum Phorum 5.0.14 |
| Not Vulnerable: |
Phorum Phorum 5.0.18 |
Discussion
Phorum Register.PHP Cross-Site Scripting Vulnerability
Phorum is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.
An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
Phorum is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.
An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
Exploit / POC
Phorum Register.PHP Cross-Site Scripting Vulnerability
No exploit is required.
No exploit is required.
Solution / Fix
Phorum Register.PHP Cross-Site Scripting Vulnerability
Solution:
The vendor has addressed this issue in version 5.0.18:
Phorum Phorum 5.0.14
Phorum Phorum 5.0.15a
Phorum Phorum 5.0.10
Phorum Phorum 5.0.11
Phorum Phorum 5.0.12
Phorum Phorum 5.0.13
Phorum Phorum 5.0.14
Phorum Phorum 5.0.16
Phorum Phorum 5.0.17 a
Solution:
The vendor has addressed this issue in version 5.0.18:
Phorum Phorum 5.0.14
-
Phorum phorum-5.0.18.tar.gz
http://phorum.org/downloads/phorum-5.0.18.tar.gz
Phorum Phorum 5.0.15a
-
Phorum phorum-5.0.18.tar.gz
http://phorum.org/downloads/phorum-5.0.18.tar.gz
Phorum Phorum 5.0.10
-
Phorum phorum-5.0.18.tar.gz
http://phorum.org/downloads/phorum-5.0.18.tar.gz
Phorum Phorum 5.0.11
-
Phorum phorum-5.0.18.tar.gz
http://phorum.org/downloads/phorum-5.0.18.tar.gz
Phorum Phorum 5.0.12
-
Phorum phorum-5.0.18.tar.gz
http://phorum.org/downloads/phorum-5.0.18.tar.gz
Phorum Phorum 5.0.13
-
Phorum phorum-5.0.18.tar.gz
http://phorum.org/downloads/phorum-5.0.18.tar.gz
Phorum Phorum 5.0.14
-
Phorum phorum-5.0.18.tar.gz
http://phorum.org/downloads/phorum-5.0.18.tar.gz
Phorum Phorum 5.0.16
-
Phorum phorum-5.0.18.tar.gz
http://phorum.org/downloads/phorum-5.0.18.tar.gz
Phorum Phorum 5.0.17 a
-
Phorum phorum-5.0.18.tar.gz
http://phorum.org/downloads/phorum-5.0.18.tar.gz