Some vulnerabilities have been reported in PunBB, which potentially can be exploited by malicious people to conduct spoofing attacks, disclose certain information, and conduct script insertion attacks.

1) An error where the "HTTP_X_FORWARDED_FOR" parameter is improperly trusted, may be exploited to spoof the IP address.

2) An error in the execution of "unregister_globals()" may be exploited to disclose certain unspecified information.

3) An input validation error in the avatar upload handling may exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site by uploading a specially crafted valid image containing embedded HTML and script code.

This is related to:
SA17295

Successful exploitation requires that the malicious avatar is accessed directly in the Microsoft Internet Explorer browser (i.e. not referenced via an image tag).

Solution
Update to 1.2.10.
Further details available in Customer Area

Provided and/or discovered by
The vendor credits Jonatan Wulcan, Stefan Esser, Smartys, and Michael "PMD" Dorman.

Changelog
Further details available in Customer Area

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area