Secunia Advisory: SA10797 Print Advisory
Release Date: 2004-02-05

Critical: Moderately critical
Impact: Cross Site Scripting, ID Spoofing
Where: From remote

Software: PHPX 3.x


Description:
Manuel L¾pez has reported multiple vulnerabilities in PHPX, allowing malicious people to conduct cross-site scripting attacks and hijack accounts.

The subject fields in Personal Messages and in the Forum, as well as the "keywords" and "body" parameters in the scripts "main.inc.php" and "help.inc.php" aren't properly verified. This can be exploited to inject arbitrary HTML and script code.

It is possible to impersonate others by manipulating the "PXL" parameter in the cookie. This can be exploited to gain administrative access.

The vulnerabilities have been reported in version 3.2.3.

Solution:
Update to version 3.2.4.
http://sourceforge.net/project/showfiles.php?group_id=67670

Provided and/or discovered by:
Manuel L¾pez

Source: Secunia

OS/2-eCS-ArcaOS General News

More in General  

OS/2-eCS-ArcaOS Software News

More in Software  

Latest Forum Posts

Site News

More in Site News