Secunia

S8Forum creates files for each username and does not verify data written to those files.

This allows malicious people to create usernames (files) like username.php, as the email address isn't verified either, it is possible to write php code as the email address, you need only to supply <? code ?>

Solution
Edit the source so that you limit usernames so that they cannot contain '.'s, also you ought to strip other input which is written to the file, as Cross Site Scripting also is possible.
Further details available in Customer Area

Provided and/or discovered by
NaSsEr .M.Sh

Deep Links
Links available in Customer Area