Release Date: 2003-12-15
Critical: Highly critical
Impact: Cross Site Scripting
System access
Where: From remote
Software: W-Agora 4.x
Description:
Some vulnerabilities have been reported in W-Agora, which may be exploited by malicious people to conduct Cross-Site Scripting attacks or include arbitrary files to compromise a vulnerable system.
The following scripts are reportedly affected:
* include/auth.php3
* editform.php3
* modules.php3
* index.php3
* insert.php3
* update.php3
* browse.php3
Reportedly, some tags in .htaccess also potentially allow POST and other requests to activate scripts.
Solution:
Update to version 4.1.6.
http://sourceforge.net/project/showfiles.php?group_id=3413
Source: Secunia