Vanilla Forums CVE-2013-3528 Multiple PHP Code Injection Vulnerabilities

Bugtraq ID:	59814
Class:	Unknown
CVE:	CVE-2013-3528
Remote:	Yes
Local:	No
Published:	Mar 22 2013 12:00AM
Updated:	Oct 09 2013 12:25AM
Credit:	Egidio Romano
Vulnerable:	Vanilla Forums Vanilla 2.0.16 Vanilla Forums Vanilla 2.0.18.4 Vanilla Forums Vanilla 2.0.17.9 Vanilla Forums Vanilla 2.0.17.6 Vanilla Forums Vanilla 2.0.17.5 Vanilla Forums Vanilla 2.0.17.4 Vanilla Forums Vanilla 2.0.17.3 Vanilla Forums Vanilla 2.0.17.2 Vanilla Forums Vanilla 2.0.17.10 Vanilla Forums Vanilla 2.0.17.1
Not Vulnerable:

Vanilla Forums CVE-2013-3528 Multiple PHP Code Injection Vulnerabilities

Vanilla Forums is prone to multiple PHP code-injection vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these issues to inject and execute arbitrary malicious PHP code in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

Versions prior to Vanilla Forums 2.0.18.8 are vulnerable.

Vanilla Forums CVE-2013-3528 Multiple PHP Code Injection Vulnerabilities

An attacker can exploit these issues using a web browser.

Vanilla Forums CVE-2013-3528 Multiple PHP Code Injection Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Vanilla Forums CVE-2013-3528 Multiple PHP Code Injection Vulnerabilities

References:

• Vanilla Forums Homepage (Vanilla Forums)