Two vulnerabilities have been reported in vbPortal allowing malicious people to manipulate emails and send emails anonymously.

1) It is possible to manipulate the header and message by injecting a linefeed (LF) in the "yname" and "ymail" parameters. This allows users to manipulate the content of the mails generated by "SendStory" and "SendSite".

2) The "SendStory" and "SendSite" functions do not verify if the user is authenticated. This can be exploited by malicious people to send emails without being authenticated.

A combination of the two vulnerabilities can be exploited to send SPAM mails anonymously.

NOTE: The "SendStory" functionality is part of PHP-Nuke.

The vulnerabilities have been reported in version 2.0 alpha 8.1. Prior versions may also be affected.

Solution
Update to version 2.30 or later.
Further details available in Customer Area

Provided and/or discovered by
frog-m@n

Changelog
Further details available in Customer Area

Original Advisory
Envoi de mails anonymes / Anonymous Mail Forwarding Vulnerabilities in vbPortal
http://www.security-corporation.com/advisories-021.html

Deep Links
Links available in Customer Area