PHPOutSourcing Zorum Cross-Site Scripting Vulnerability

Bugtraq ID:	8388
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 11 2003 12:00AM
Updated:	Aug 11 2003 12:00AM
Credit:	Discovery credited to G00db0y.
Vulnerable:	PHPOutsourcing Zorum 3.5 PHPOutsourcing Zorum 3.4 PHPOutsourcing Zorum 3.3 PHPOutsourcing Zorum 3.2 PHPOutsourcing Zorum 3.1 PHPOutsourcing Zorum 3.0
Not Vulnerable:

PHPOutSourcing Zorum Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability has been reported in the index.php script of PHPOutSourcing Zorum. Because of this, an attacker may be able to execute HTML and script code in the browsers of target users in the security context of the site hosting the vulnerable script.

PHPOutSourcing Zorum Cross-Site Scripting Vulnerability

The following proof-of-concept has been made available:

http://www.example.com/pathofzorum/index.php?method=<script>alert('test')
</script>

PHPOutSourcing Zorum Cross-Site Scripting Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

PHPOutSourcing Zorum Cross-Site Scripting Vulnerability

References:

• Zorum Home Page (PHPOutsourcing)
  
• ZH2003-22SA (security advisory): Zorum XSS Vulnerability and Path Disclosure (G00db0y )