Phorum 3.x register.php HTTP_REFERER XSS

2004-03-15T00:00:00
ID EDB-ID:23818
Type exploitdb
Reporter JeiAr
Modified 2004-03-15T00:00:00

Description

Phorum 3.x register.php HTTP_REFERER XSS. CVE-2004-1822. Webapps exploit for php platform

                                        
                                            source: http://www.securityfocus.com/bid/9882/info

It has been reported that Phorum is prone to a cross-site scripting vulnerability across multiple modules. The issue presents itself across multiple modules including 'login.php', 'register.php', and 'profile.php'. These modules employ two hidden variables named 'f' and 'target', which are passed user-supplied input values from HTTP_REFERER without proper sanitization.

Phorum versions 5.0.3 Beta and prior are reported to be vulnerable to this issue.

register.php?&HTTP_REFERER=[XSS]