Release Date: 2004-02-05
Critical: Moderately critical
Impact: Cross Site Scripting, ID Spoofing
Where: From remote
Software: PHPX 3.x
Description:
Manuel L¾pez has reported multiple vulnerabilities in PHPX, allowing malicious people to conduct cross-site scripting attacks and hijack accounts.
The subject fields in Personal Messages and in the Forum, as well as the "keywords" and "body" parameters in the scripts "main.inc.php" and "help.inc.php" aren't properly verified. This can be exploited to inject arbitrary HTML and script code.
It is possible to impersonate others by manipulating the "PXL" parameter in the cookie. This can be exploited to gain administrative access.
The vulnerabilities have been reported in version 3.2.3.
Solution:
Update to version 3.2.4.
http://sourceforge.net/project/showfiles.php?group_id=67670
Provided and/or discovered by:
Manuel L¾pez
Source: Secunia