Secunia

int_main(); has reported some vulnerabilities in PHP Forum Hoster Portal Script, which can be exploited by malicious users to conduct script insertion attacks and to manipulate certain data.

1) Input passed via the "title" and "body" parameters when posting a new topic is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious post is being viewed.

2) An error in manageforum.php can be exploited to delete arbitrary topics by accessing the script and providing valid arbitrary values in the "forum" and "delt" parameters.

Solution
Restrict access to trusted users only.

Provided and/or discovered by
int_main();

Original Advisory
http://milw0rm.com/exploits/9378

Deep Links
Links available in Customer Area