PT-2008-5746 · Phorum · Phorum

Published 2008-10-09 · Updated 2017-08-08 · CVE-2008-4513

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Phorum version 5.2.8

Description: A cross-site scripting (XSS) issue exists due to the improper handling of nested BBcode image tags in the BBcode API module. This allows remote attackers to inject arbitrary web script or HTML.

Recommendations: For Phorum version 5.2.8, update the BBcode API module to a version that properly sanitizes nested BBcode image tags to prevent XSS attacks. As a temporary workaround, consider disabling the use of nested BBcode image tags in the BBcode API module until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-4513

Affected Products

Phorum

References · 8

• 🔥 http://trac.phorum.org/changeset/3528 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-4513 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4513 · Note
• http://secunia.com/advisories/32225 · Note
• http://securityfocus.com/bid/31589 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45686 · Note
• http://phorum.org/phorum5/read.php?64%2C133699 · Note
• http://nulledcore.com/?p=126 · Note