CS-Forum <= 0.81 Cross Site Scripting, SQL Injection, Full Path Disclosure

[gmdarkfig () gmail com]

Cross Site Scripting
********************
http://[...]/read.php?msg_result=[XSS]
http://[...]/read.php?rep_titre=";>[XSS]
Cookies: CSForum_nom=">[XSS]; CSForum_mail=">[XSS]; CSForum_url=">[XSS]

SQL Injection
*************
http://[...]/read.php?id=1'[SQL_SELECT]&debut=[SQL_LIMIT]
http://[...]/index.php?search=%'[SQL_SELECT]%23
http://[...]/index.php?debut=1[SQL] //Digit -> Without quote

Full Path Disclosure 
********************
http://[...]/index.php?readall=&collapse[]= //setcookie()


Solution
********
SQL Injection => addslashes() / intval()
Cross Site Scripting => htmlentities()
Full Path Disclosure => is_string()


Credits
*******
by DarkFig -- http://www.acid-root.new.fr/advisories/csforum081.txt


Changelog
*********
[06-06-11] -- Vendor contacted