Phorum Cross Site Scripting Vulnerabilities

Bugtraq ID:	4767
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 18 2002 12:00AM
Updated:	May 18 2002 12:00AM
Credit:	Credited to Markus Arndt <[email protected]>.
Vulnerable:	Phorum Phorum 3.3.2 a Phorum Phorum 3.3.2
Not Vulnerable:	Phorum Phorum 3.3.2 b3

Phorum Cross Site Scripting Vulnerabilities

Phorum is a PHP based web forums package designed for most UNIX variants, Linux, and Microsoft Windows operating systems.

The 'header.php' and 'footer.php' components of Phorum do not santize the client-supplied value of the 'GLOBALS' parameter prior to output. As a result, script commands embedded in these variables will be executed by the client in the context of Phorum.

Attackers may exploit this vulnerability to obtain user credentials.

Phorum Cross Site Scripting Vulnerabilities

The following was provided as a proof of concept:

http://[host]/phorum/admin/footer.php?GLOBALS[message]=<script>alert("css strikes!");</script>

http://[host]/phorum/admin/header.php?GLOBALS[message]=<script>alert("css strikes!");</script>

Phorum Cross Site Scripting Vulnerabilities

Solution:
The vendor has released a new version to address this issue.


Phorum Phorum 3.3.2

• Phorum phorum-3.3.2b3.tar.gz
  http://phorum.org/downloads/phorum-3.3.2b3.tar.gz

Phorum Phorum 3.3.2 a

• Phorum phorum-3.3.2b3.tar.gz
  http://phorum.org/downloads/phorum-3.3.2b3.tar.gz

Phorum Cross Site Scripting Vulnerabilities

References:

• Phorum Homepage (Phorum)