JeiAr has discovered some vulnerabilities in Phorum, allowing malicious people to conduct Cross Site Scripting attacks.

The problem is that certain input isn't properly verified. While the "<SCRIPT>" tag is stripped from input, it is still possible to inject arbitrary HTML and script code included in HTML tags.

1) Input to the "HTTP_REFERER" parameter in "login.php" isn't properly verified before it is returned to the user.
2) Input to the "HTTP_REFERER" parameter in "register.php" isn't properly verified before it is returned to the user.
3) Input to the "target" parameter in "profile.php" isn't properly verified before it is returned to the user.

The vulnerabilities affect versions prior to 3.4.7. This also been reported to affect 5.0.3 beta.

Solution
Update to version 3.4.7:
Further details available to Secunia VIM customers

Provided and/or discovered by
JeiAr of the GulfTech Security Research Team

Original Advisory
http://www.gulftech.org/03152004.php

Deep Links
Links available to Secunia VIM customers