Description:

It is possible to insert javascript code in a message and execute it.

1.) go to a phorum

2.) click on new topic

3.) enter any name

4.) enter any email

5.) enter a title in the way like this "><script>alert

("Vulnerable");</script>

6.) enter any text

7.) click the preview button

8.) click the send button on the top of the page

Solution:

Edit the source code to strip malicious characters from title or escape

malicious characters using addslashes().

[ reply ]