Re: Phorum HTML Injection Vulnerability

To: bugtraq@xxxxxxxxxxxxxxxxx
Subject: Re: Phorum HTML Injection Vulnerability
From: brian@xxxxxxxxxx
Date: 29 Jan 2007 20:22:43 -0000
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm

I have emailed this reporter about this already.  Other than allowing 
characters such as " and >< in a user name, there is nothing vulnerable about 
this page.  The characters are escaped properly on this page when there is an 
error.  I have asked for more information about this issue both via email and 
on our own bug tracking system.  I have received no reply so far.

Phorum 5.1.18 did include a FIX for an XSS issue.  But, it does not appear that 
this reporter is referring to that.

Prev by Date: Re: Fake: Open Conference Systems = 2.8.2 Remote File Inclusion
Next by Date: Re: Windows logoff bug possible security vulnerability and exploit.
Previous by thread: Phorum HTML Injection Vulnerability
Next by thread: gnopaste <= 0.5.3 (index.php) Remote File Include Vulnerability
Index(es):
- Date
- Thread