Morinex Eneco has reported two vulnerabilities in Direct Topics, which can be exploited by malicious people to conduct script insertion and SQL injection attacks.
1) Input passed to the "topic" parameter in "topic.php" isn't properly sanitized before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
2) Certain input passed in BB Code is not properly sanitized before being used. This can be exploited to inject arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious post is viewed.
Example:
[img]javascript:[code][/img]
The vulnerabilities have been reported in version 2, 2.1 and 2.2. Other versions may also be affected.
SOFTWARE:
Direct Topics 2.x
SOLUTION:
Edit the source code to ensure that input is properly sanitized.
VERIFY ADVISORY:
http://secunia.com/advisories/15353/
Secunia Security Advisories
http://community.securityteam.us/article.php/20050516101532467