12 lines
No EOL
931 B
Text
12 lines
No EOL
931 B
Text
source: https://www.securityfocus.com/bid/12777/info
|
|
|
|
Zorum is a freely available, open source Web-based forum application implemented in PHP. It is available for UNIX, Linux, and any other platform that supports PHP script execution.
|
|
|
|
Multiple remote vulnerabilities affect Zorum. These issues are due to a failure of the application to validate access rights and user-supplied input.
|
|
|
|
The issues reported are an HTML injection vulnerability, multiple cross-site scripting vulnerabilities, an SQL injection vulnerability, and an authentication bypass issue.
|
|
|
|
An attacker may leverage these issues to execute script code in an unsuspecting user's browser, to manipulate SQL queries and to bypass authentication requirements.
|
|
|
|
http://www.example.com/zorum_3_5/index.php?list="/><script>alert()</script>
|
|
http://www.example.com/zorum_3_5/index.php?method=markread&list=zorumuser&fromlist=secmenu&frommethod="/><script>alert()</script> |