https://www.exploit-db.com/exploits/25206

漏洞细节尚未披露

source: http://www.securityfocus.com/bid/12777/info

Zorum is a freely available, open source Web-based forum application implemented in PHP. It is available for UNIX, Linux, and any other platform that supports PHP script execution.

Multiple remote vulnerabilities affect Zorum. These issues are due to a failure of the application to validate access rights and user-supplied input.

The issues reported are an HTML injection vulnerability, multiple cross-site scripting vulnerabilities, an SQL injection vulnerability, and an authentication bypass issue.

An attacker may leverage these issues to execute script code in an unsuspecting user's browser, to manipulate SQL queries and to bypass authentication requirements.

http://www.example.com/zorum_3_5/index.php?list="/><script>alert()</script>
http://www.example.com/zorum_3_5/index.php?method=markread&list=zorumuser&fromlist=secmenu&frommethod="/><script>alert()</script>