source: https://www.securityfocus.com/bid/12852/info
Multiple remote input validation vulnerabilities affect CoolForum. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it to carry out critical functionality.
Multiple SQL injection vulnerabilities have been reported and a cross-site scripting vulnerability is also reported.
An attacker may leverage these issues to manipulate and view arbitrary database contents by exploiting the SQL injection issues, and to have arbitrary script code executed in the browser of an unsuspecting user by exploiting the cross-site scripting vulnerabilities.
avatar.php?img=<script>alert(document.cookie)</script>
