Laurent Gaffié and Benjamin Mossé have reported some vulnerabilities in Vikingboard, which can be exploited by malicious users to disclose certain sensitive information and conduct script insertion attacks.

1) Input passed to the "pm_title" form field parameter when sending a private message is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in another user's browser session in context of an affected site when the malicious message is viewed.

2) Input passed to the "act" parameter in admin.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local resources.

Successful exploitation requires administrative privileges.

The vulnerabilities have been reported in version 0.1.2. Other versions may also be affected.

Solution
Fixed in the SVN repository.

Provided and/or discovered by
Laurent Gaffié and Benjamin Mossé

Changelog
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers