TITLE:
TinyPHPForum Script Insertion and Disclosure of Sensitive Information

SECUNIA ADVISORY ID:
SA18293

VERIFY ADVISORY:
http://secunia.com/advisories/18293/

CRITICAL:
Moderately critical

IMPACT:
Cross Site Scripting, Exposure of system information, Exposure of
sensitive information

WHERE:
>From remote

SOFTWARE:
TinyPHPForum 3.x
http://secunia.com/product/6748/

DESCRIPTION:
Aliaksandr Hartsuyeu has discovered two vulnerabilities and a
security issue in TinyPHPForum, which can be exploited by malicious
people to conduct script insertion attacks and disclose sensitive
information.

1) Input passed to the URL of a link when posting a message isn't
properly verified before being used. This can be exploited to inject
arbitrary JavaScript code, which will be executed in a user's browser
session in context of an affected site when a link with the
"javascript:" URI handler is followed in a malicious message.

2) The problem is that user credentials are stored insecurely in the
"users" directory inside the web root. This can be exploited to
disclose users' encrypted passwords and other information.

3) Input passed to the "uname" parameter in "profile.php" when
viewing a profile isn't properly sanitised before being used to view
user content. This can be exploited to disclose the content of
arbitrary files via directory traversal attacks.

Successful exploitation requires that "magic_quotes_gpc" is
disabled.

Some other parameters when creating new users and topics may also be
affected.

The vulnerabilities and the security issue have been confirmed in
version 3.6. Other versions may also be affected.

SOLUTION:
Edit the source code to ensure that input is properly sanitised and
verified, and restrict access to the "users" directory via the web
interface (e.g. with a .htaccess file).

PROVIDED AND/OR DISCOVERED BY:
Aliaksandr Hartsuyeu

ORIGINAL ADVISORY:
http://evuln.com/vulns/14/summary.html

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------