Secunia

Multiple vulnerabilities have been identified in InterForum allowing malicious users to gain access to private messages and gain administrative privileges.

1) It is possible to conduct Cross Site Scripting in the user profile and in messages due to lack of input validation. Trivial Cross Site Scripting is possible using "<script>".

2) It is possible to read any private message, because the ownership isn't verified. This is possible by supplying arbitrary integer values for the "pmid" parameter in the "pm.php" script.

3) It is possible to edit any profile including the administrative profile by sending an updated profile to "/member.php?action=editpro&editlogsubmit=1" with an arbitrary username (e.g. "admin").

Solution
The website hosting InterForum seems to have "disappeared".
Further details available in Customer Area

Provided and/or discovered by
Mask_NBTA

Deep Links
Links available in Customer Area