----------------------------------------------------------------------

Hardcore Disassembler / Reverse Engineer Wanted!

Want to work with IDA and BinDiff?
Want to write PoC's and Exploits?

Your nationality is not important.
We will get you a work permit, find an apartment, and offer a
relocation compensation package.

http://secunia.com/hardcore_disassembler_and_reverse_engineer/

----------------------------------------------------------------------

TITLE:
Phorum Cross-Site Scripting and Local File Inclusion

SECUNIA ADVISORY ID:
SA21043

VERIFY ADVISORY:
http://secunia.com/advisories/21043/

CRITICAL:
Moderately critical

IMPACT:
Cross Site Scripting, Exposure of sensitive information, System
access

WHERE:
>From remote

SOFTWARE:
Phorum 5.x
http://secunia.com/product/4144/

DESCRIPTION:
Some vulnerabilities have been discovered in Phorum, which can be
exploited by malicious people to conduct cross-site scripting
attacks, disclose sensitive information, and potentially compromise a
vulnerable system.

1) Input passed to the "template" parameter in pm.php isn't properly
verified, before it is used to include files. This can be exploited
to include arbitrary files from local resources.

Example:
http://[host]/pm.php?1,page=1&template=[file]%00

Another unspecified parameter is reportedly also affected.

Successful exploitation requires that "register_globals" is enabled
and that "magic_quotes_gpc" is disabled.

This can further be exploited to include arbitrary PHP code injected
into Apache web logs.

2) Input passed to the "mode" parameter in posting.php isn't properly
sanitised before being returned to the user. This can be exploited to
execute arbitrary HTML and script code in a user's browser session in
context of an affected site.

The vulnerabilities have been confirmed in version 5.1.14. Prior
versions may also be affected.

SOLUTION:
Update to version 5.1.15.
http://www.phorum.org/downloads.php

PROVIDED AND/OR DISCOVERED BY:
1) rgod
Additional information provided by the vendor.

2) Reported by the vendor.

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------