Phorum 'real_name' Parameter Cross Site Scripting Vulnerability

Bugtraq ID:	49347
Class:	Input Validation Error
CVE:	CVE-2011-3392
Remote:	Yes
Local:	No
Published:	Aug 29 2011 12:00AM
Updated:	Apr 13 2015 09:01PM
Credit:	Russ McRee
Vulnerable:	Phorum Phorum 5.2.16 Phorum Phorum 5.2.11 Phorum Phorum 5.2.10 -RC1 Phorum Phorum 5.2.10 Phorum Phorum 5.2.8 Phorum Phorum 5.2.6 Phorum Phorum 5.2.12a Phorum Phorum 5.2-dev Phorum Phorum 5.2
Not Vulnerable:	Phorum Phorum 5.2.17

Phorum 'real_name' Parameter Cross Site Scripting Vulnerability

Phorum is prone to multiple cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input.

An attacker can exploit this issue to steal cookie-based authentication credentials and launch other attacks.

Phorum 5.2.16 and prior are vulnerable.

Phorum 'real_name' Parameter Cross Site Scripting Vulnerability

To exploit these issues, an attacker must entice an unsuspecting victim into following a malicious URI.

Phorum 'real_name' Parameter Cross Site Scripting Vulnerability

Solution:
The vendor has released an update. Please see the references for more information.

Phorum 'real_name' Parameter Cross Site Scripting Vulnerability

References:

• Phorum 5.2.17 released - SECURITY FIX (Russ McRee)
  
• Phorum Homepage (Phorum)
  
• HIO-2011-0822 Phorum 5.2.16 XSS Vulnerability (HolisticInfoSe)