A Phorum's bug...

[WiciU]

Hi!
I have founded a bug in Phorum (http://phorum.org/).
It is possible to inject script code or other html-tag into "subject",
"author's name" or "author's e-mail" of a message in Phorum.
In the subject (name, e-mail) input of message you need to write any
html-tag like this:
<<b>script>alert(document.cookie);<<b>/script>
I have tested it on Phorum 3.4.1 but probably works in other Phorum 3.x.x
versions.
Greetings!

WiciU, Poland
vviciu@poczta.onet.pl

[Brian Moon]

In-Reply-To: <20030509173709.14620.qmail@www.securityfocus.com>

Phorum 3.4.3 has been released fixing this and a couple
of other bugs.

Brian Moon
Phorum Dev Team
http://phorum.org/

[black c0de]

"Brian Moon" <brian@phorum.org> wrote in message
news:b9h4v7$skd$1@FreeBSD.csie.NCTU.edu.tw...
> In-Reply-To: <20030509173709.14620.qmail@www.securityfocus.com>
>
> Phorum 3.4.3 has been released fixing this and a couple
> of other bugs.

v3.4.1 has this bug ?

--
black c0de //[tN] :: [The N0b0D1eS] :: [icq: #6767252] ::
[http://nteam.ru/]