Title: Forumwa Multiple Remote Input Validation Vulnerabilities
Severity: MODERATE
Description:
Forumwa is a simple discussion forum, based on PHP and MYSQL.
Forumwa is reportedly affected by multiple remote input validation vulnerabilities. These issues are due to the application failing to properly sanitize user-supplied input.
The application is vulnerable to a cross-site scripting attack permitting an attacker to construct a malicious link containing script code to be executed in the context of the affected site. This issue is due to a failure of the application to sanitize the search string of 'search.php' of harmful characters such as ", < and >. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
The application is vulnerable to a HTML injection attack. This issue occurs because the body of a message to the forum is not properly sanitized of potentially harmful characters such as < and >. Attacker-supplied HTML and script code in the body of a message would be able to access properties of the site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user, other attacks are also possible.
Affected Products:
- Demof Forumwa 0.0.0v1
References:
- Forumwa: Forumwa Homepage
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
