0-Day Flaws in Vanilla Forums Let Remote Attackers Hack Websites
May 12, 2017
A security researcher has publicly disclosed two critical zero-day vulnerabilities in Vanilla Forums, an open source software that powers discussion on over 500,000 websites, which could allow unauthenticated, remote attackers to fully compromise targeted websites easily. Discovered by Polish security researcher Dawid Golunski of Legal Hackers, two separate unpatched vulnerabilities, a remote code execution ( CVE-2016-10033 ) and host header injection ( CVE-2016-10073 ), affect the latest version of Vanilla Forums 2.3, leaving hundreds of thousands of websites and their visitors vulnerable to various hacking attacks. Vanilla Forums: Remote Code Execution Flaw According to Golunski, both vulnerabilities technically exist because Vanilla Forum is still using a vulnerable version of PHPMailer , one of the most popular open source PHP libraries used to send emails. Last year Golunski reported a critical remote code execution flaw ( CVE-2016-10033 ) in PHPMailer library that al...
