ID:5199 - Exploit for Information disclosure in JForum - CVE-2019-7550

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists in the create user function due to the way the software handles messages based on username validity. A remote attacker can send mass register/check/username?username= requests to access sensitive information, such as valid usernames, to enumerate within the customer environment.

Remediation