Phorum Register.PHP Existing User HTML Injection Vulnerability

Bugtraq ID:	7584
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 13 2003 12:00AM
Updated:	May 13 2003 12:00AM
Credit:	This vulnerability was reported by <[email protected]>.
Vulnerable:	Phorum Phorum 3.4.2 Phorum Phorum 3.4.1 Phorum Phorum 3.4
Not Vulnerable:	Phorum Phorum 3.4.3

Phorum Register.PHP Existing User HTML Injection Vulnerability

Phorum is prone to HTML injection attacks. HTML and script code may be echoed back when an existing user is specified from the registration page. This could potentially permit a malicious attacker to cause the execution of hostile HTML and script code in the web client of a user who visits a vulnerable site hosting Phorum.

Phorum Register.PHP Existing User HTML Injection Vulnerability

There is no exploit required.

Phorum Register.PHP Existing User HTML Injection Vulnerability

Solution:
This vulnerability does not affect Phorum 3.4.3. Users are advised to upgrade:


Phorum Phorum 3.4

• Phorum phorum-3.4.3.tar.gz
  http://phorum.org/downloads/phorum-3.4.3.tar.gz

Phorum Phorum 3.4.1

• Phorum phorum-3.4.3.tar.gz
  http://phorum.org/downloads/phorum-3.4.3.tar.gz

Phorum Phorum 3.4.2

• Phorum phorum-3.4.3.tar.gz
  http://phorum.org/downloads/phorum-3.4.3.tar.gz

Phorum Register.PHP Existing User HTML Injection Vulnerability

References:

• Phorum Homepage (Phorum)
  
• Phorum Vulnerabilities ()