Phorum Multiple Cross Site Scripting Vulnerabilities
BID:34551
Info
Phorum Multiple Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 34551 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 16 2009 12:00AM |
| Updated: | Apr 17 2009 07:46PM |
| Credit: | voodoo-labs |
| Vulnerable: |
Phorum Phorum 5.2.10 Phorum Phorum 5.2-dev |
| Not Vulnerable: | |
Discussion
Phorum Multiple Cross Site Scripting Vulnerabilities
Phorum is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
An attacker can exploit these issues to steal cookie-based authentication credentials and launch other attacks.
Phorum 5.2.10 and 5.2-dev are vulnerable; other versions may also be affected.
Phorum is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
An attacker can exploit these issues to steal cookie-based authentication credentials and launch other attacks.
Phorum 5.2.10 and 5.2-dev are vulnerable; other versions may also be affected.
Exploit / POC
Phorum Multiple Cross Site Scripting Vulnerabilities
To exploit these issues, an attacker must entice an unsuspecting victim into following a malicious URI.
The following examples are available:
To exploit these issues, an attacker must entice an unsuspecting victim into following a malicious URI.
The following examples are available:
Solution / Fix
Phorum Multiple Cross Site Scripting Vulnerabilities
Solution:
The vendor has released an update. Please see the references for more information.
Solution:
The vendor has released an update. Please see the references for more information.
References
Phorum Multiple Cross Site Scripting Vulnerabilities
References:
References: