Bugtraq mailing list archives
Re: XXS in script Phorum
From: brian () phorum org
Date: 26 Feb 2007 22:44:34 -0000
Once again, a false report about Phorum. Please issue an apology ASAP. 1. upgradefiles as a var is only used inside a function. PHP does not take variables from the global scope for use in functions automatically. 2. 2 lines before that var is echoed, it is set by reading a file name from disk using the dir() function in PHP. 3. The dir() function reads from a hard coded, relative path on disk and does not use a variable. Thanks for trying. If you find a real bug, please let us know. We strive to make Phorum as bug free as possible.
Current thread:
- XXS in script Phorum c_r_ck (Feb 26)
- <Possible follow-ups>
- Re: XXS in script Phorum brian (Feb 26)