phpoutsourcing zorum 3.5 - Multiple Vulnerabilities

                                                source: http://www.securityfocus.com/bid/12777/info

Zorum is a freely available, open source Web-based forum application implemented in PHP. It is available for UNIX, Linux, and any other platform that supports PHP script execution.

Multiple remote vulnerabilities affect Zorum. These issues are due to a failure of the application to validate access rights and user-supplied input.

The issues reported are an HTML injection vulnerability, multiple cross-site scripting vulnerabilities, an SQL injection vulnerability, and an authentication bypass issue.

An attacker may leverage these issues to execute script code in an unsuspecting user's browser, to manipulate SQL queries and to bypass authentication requirements.

http://www.example.com/zorum_3_5/index.php?list="/><script>alert()</script>
http://www.example.com/zorum_3_5/index.php?method=markread&list=zorumuser&fromlist=secmenu&frommethod="/><script>alert()</script>