Secunia

Heintz has discovered two vulnerabilities in XMB Forum, which can be exploited by malicious users to overwrite certain server set variables or conduct SQL injection attacks.

1) An incorrect use of the "extract()" function in xmb.php can be exploited to overwrite certain server set variables (e.g. _SERVER[REMOTE_ADDR]).

2) Input passed to the "u2u_select" parameter in "include/u2u.inc.php" isn't properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

The vulnerabilities have been confirmed in version 1.9.1. Other versions may also be affected.

Solution
Update to version 1.9.10 or later.

Provided and/or discovered by
Heintz

Changelog
Further details available in Customer Area

Original Advisory
http://forums.xmbforum.com/viewthread.php?tid=754523
http://forums.xmbforum.com/viewthread.php?tid=773046

Deep Links
Links available in Customer Area