Phorum 5.2 - adminbanlist.php?curr Cross-Site Scripting

Phorum 5.2 - adminbanlist.php?curr Cross-Site Scripting source: https://www.securityfocus.com/bid/34551/info Phorum is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input. An attacker can exploit these issues to steal...

Phorum Cross Site Scripting / Request Forgery

=cicatriz ==advisories= / / / / // / / // / o / / .-/ =Phorum 5.2.10 Cross-Site Scripting/Request Forgery==/= == =Advisory & Vulnerability Information=== Title: Phorum 5.2.10 Cross-Site Scripting/Request Forgery Advisory ID: VUDO-2009-1504 Advisory URL: http://research.voodoo-labs.org/advisories/...

Phorum Detection (HTTP)

HTTP based detection of Phorum. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.100108";...

CVE-2009-0488

Cross-site scripting XSS vulnerability in Phorum before 5.2.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in Phorum before 5.2.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-0488

Cross-site scripting XSS vulnerability in Phorum before 5.2.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-0488

Phorum (PHP-based forum software) is affected by a cross-site scripting (XSS) vulnerability in versions prior to 5.2.10. The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The NVD entry assigns a CVSSv2 base score of 4.3 (MEDIUM) with network attack ...

Phorum 3.0.x的几个安全漏洞

Phorum是用PHP编写的基于WEB的讨论组（BBS）软件。该软件包被发现存在几个安全漏洞，攻击者可以借此入侵Phorum运行的主机。 Admin.php3 Admin.php3脚本用于安全和管理被创建的论坛。它带有口令保护，但利用其漏洞可以修改口令，然后穿过所有认证程序为所欲为。 如下URL可以将管理口令修改为'flow'： http://www.example.com/admin.php3?step=4&option=pass&confirm=flow&newPssword=flow 一旦拥有了管理功能的访问权限，就可以轻易读取该httpd服务器所在主机的任何文件。进入 Maste...

Phorum admin.php3无需验证修改管理员口令漏洞

BUGTRAQ: 2271 Phorum是一款基于PHP的WEB论坛程序，可使用在Linux和Unix操作系统下，也可使用在Microsoft Windows操作系统下。Phorum存在一个问题，远程攻击者可以访问本地系统文件。 admin.php3脚本用于安全和管理被创建的论坛。它带有口令保护，但存在漏洞可以无需访问权限修改管理员口令。一旦拥有了管理功能的访问权限，就可以进入 Master Setting 功能，在 default .langfile name 输入框输入想要访问的系统本地文件，重新载入admin.php3页面后就可以浏览这个文件的内容了。 3.0.7 and...

Phorum violation.php3转发任意邮件漏洞

BUGTRAQ: 2272 Phorum是一款基于PHP的WEB论坛程序，可使用在Linux和Unix操作系统下，也可使用在Microsoft Windows操作系统下。Phorum存在一个漏洞允许远程用户发送任意邮件，而且不需要任何验证。 violation.php3处理URL的参数，通过主机的MTA给Mod参数指定的email发送邮件，不过要记住的是，这封电子邮件会包含攻击者的IP（或代理服务器IP）和FQDN。恶意用户可能利用这个漏洞发送垃圾邮件或邮件炸弹等行径，可能让WEB主机的IP被加入垃圾邮件服务器的黑名单。 3.0.7 and Previous Brian Moon...

CVE-2008-4513

Cross-site scripting XSS vulnerability in BBcode API module in Phorum 5.2.8 allows remote attackers to inject arbitrary web script or HTML via nested BBcode image tags...

Cross site scripting

Cross-site scripting XSS vulnerability in BBcode API module in Phorum 5.2.8 allows remote attackers to inject arbitrary web script or HTML via nested BBcode image tags...

CVE-2008-4513

CVE-2008-4513 describes a cross-site scripting (XSS) vulnerability in the BBcode API module of Phorum 5.2.8. The issue allows remote attackers to inject arbitrary web script or HTML via nested BBcode image tags. This is documented in multiple sources (NVD entry and related CVE records). The provi...

CVE-2008-4513

Cross-site scripting XSS vulnerability in BBcode API module in Phorum 5.2.8 allows remote attackers to inject arbitrary web script or HTML via nested BBcode image tags...

Phorum cross-site scripting vulnerability

Overview Phorum, an open source message board system, contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the user's web browser. Solution None...

CVE-2008-1486

SQL injection vulnerability in Phorum before 5.2.6, when mysqluseft is disabled, allows remote attackers to execute arbitrary SQL commands via the non-fulltext search...

Sql injection

SQL injection vulnerability in Phorum before 5.2.6, when mysqluseft is disabled, allows remote attackers to execute arbitrary SQL commands via the non-fulltext search...

CVE-2008-1486

Phorum vulnerability CVE-2008-1486 affects Phorum before version 5.2.6. When mysql_use_ft is disabled, an attacker can perform SQL injection through the non-fulltext search, enabling arbitrary SQL commands on the backend. The CVSS-derived assessment in the connected records cites network access w...

CVE-2008-1486

SQL injection vulnerability in Phorum before 5.2.6, when mysqluseft is disabled, allows remote attackers to execute arbitrary SQL commands via the non-fulltext search...

CVE-2002-2340

The vulnerability CVE-2002-2340 affects Phorum 3.3.2a, specifically the read.php component. The issue is a Cross-site Scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML via (1) the t parameter or (2) the body of an email response. The public descript...