Phorum contains an input validation error, which can be exploited by malicious users to conduct Cross-Site Scripting attacks against other users.

User input supplied to the title field is not validated, which can be exploited by posting a malicious entry containing script code in the title field. The script code will be executed in the user's browser session, when the malicious entry is viewed.

Successful exploitation can result in disclosure of various information (eg. cookie-based authentication information) associated with the site running Phorum or inclusion of malicious content, which the user thinks is part of the real website.

Note: The vulnerability has been confirmed in version 3.4, but prior versions might also be vulnerable.

Solution
Update to version 3.4.2:
Further details available in Customer Area

Provided and/or discovered by
Peter "Stöckli"

Deep Links
Links available in Customer Area