CVE-2005-2836: XSS
Multiple cross-site scripting (XSS) vulnerabilities in Phorum 5.0.17a and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the username parameter to register.php or (2) a signature of a logged-in user in "My Control Center," which is not properly handled by control.php.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2005-2836?
CVE-2005-2836 has a high severity due to its potential for cross-site scripting (XSS) attacks, allowing attackers to inject arbitrary web scripts or HTML.
How do I fix CVE-2005-2836?
To fix CVE-2005-2836, update Phorum to version 5.0.18 or later, which addresses the XSS vulnerabilities.
Which versions of Phorum are affected by CVE-2005-2836?
CVE-2005-2836 affects Phorum versions 5.0.17 and earlier, as well as several earlier 3.x versions.
What types of inputs can be exploited in CVE-2005-2836?
The exploitation in CVE-2005-2836 can occur through the username parameter in register.php and user signatures within My Control Center.
What effect can CVE-2005-2836 have on users?
CVE-2005-2836 can lead to unauthorized script execution in the user's browser, potentially compromising user data and session integrity.