Phorum 5.0.14 - Multiple Subject and Attachment HTML Injection Vulnerabilities

source: https://www.securityfocus.com/bid/12800/info Phorum is reportedly affected by multiple HTML injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content. The attacker-supplied HTML...

[SA14554] Phorum Unspecified Cross-Site Scripting Vulnerability

---------------------------------------------------------------------- Monitor, Filter, and Manage Security Information - Filtering and Management of Secunia advisories - Overview, documentation, and detailed reports - Alerting via email and SMS Request Trial: https://ca.secunia.com/?f=l...

CVE-2004-1518

SQL injection vulnerability in follow.php in Phorum 5.0.12 and earlier allows remote authenticated users to execute arbitrary SQL command via the forumid parameter...

CVE-2004-1518

Phorum 5.0.12 and earlier is affected by an SQL injection in follow.php triggered through the forum_id parameter. The vulnerability allows remote authenticated users to execute arbitrary SQL commands, indicating the issue lies in improper handling/validation of the forum_id input. Affected produc...

CVE-2004-2110

SQL injection vulnerability in register.php in Phorum before 3.4.6 allows remote attackers to execute arbitrary SQL commands via the hideemail parameter...

CVE-2004-2242

Cross-site scripting XSS vulnerability in search.php in Phorum, possibly 5.0.7 beta and earlier, allows remote attackers to inject arbitrary HTML or web script via the subject parameter...

CVE-2004-2240

Multiple SQL injection vulnerabilities in Phorum 5.0.11 and earlier allow remote attackers to modify SQL statements via 1 the query string in read.php or 2 unknown vectors in file.php...

CVE-2004-1518

SQL injection vulnerability in follow.php in Phorum 5.0.12 and earlier allows remote authenticated users to execute arbitrary SQL command via the forumid parameter...

CVE-2004-2243

Phorum allows remote attackers to hijack sessions of other users by stealing and replaying the session hash in the phorumuriauth parameter, as demonstrated using profile.php. NOTE: the affected version was reported to be 4.3.7, but this may be erroneous...

CVE-2004-2241

Cross-site scripting XSS vulnerability in Phorum 5.0.11 and earlier allows remote attackers to inject arbitrary HTML or web script via search.php. NOTE: some sources have reported that the affected file is read.php, but this is inconsistent with the vendor's patch...

[waraxe-2004-SA#037 - Sql injection bug in Phorum 5.0.12 and older versions]

================================================================================ waraxe-2004-SA037 ================================================================================ Sql injection bug in Phorum 5.0.12 and older versions...

waraxe-2004-SA037.txt

================================================================================ waraxe-2004-SA037 ================================================================================ Sql injection bug in Phorum 5.0.12 and older versions...

Phorum 5.0.x - FOLLOW.php SQL Injection

Phorum 5.0.x - FOLLOW.php SQL Injection source: https://www.securityfocus.com/bid/11660/info Reportedly Phorum is affected by a remote SQL injection vulnerability. This issue is due to a failure of the application to properly sanitized user supplied URI input. This issue allows remote attackers t...

[SA12980] Phorum Unspecified Cross-Site Scripting and SQL Injection

TITLE: Phorum Unspecified Cross-Site Scripting and SQL Injection SECUNIA ADVISORY ID: SA12980 VERIFY ADVISORY: http://secunia.com/advisories/12980/ CRITICAL: Moderately critical IMPACT: Cross Site Scripting, Manipulation of data WHERE: From remote SOFTWARE: Phorum 5.x...

Phorum 5.0.11 - Read.php SQL Injection

Phorum 5.0.11 - Read.php SQL Injection source: https://www.securityfocus.com/bid/14095/info Phoroum is prone to SQL injection attacks. Insufficient sanitization of user input may allow a malicious user to manipulate the structure and logic of database queries. Successful exploitation could allow...

Phorum 5.0.11 - 'Read.php' SQL Injection

source: https://www.securityfocus.com/bid/14095/info Phoroum is prone to SQL injection attacks. Insufficient sanitization of user input may allow a malicious user to manipulate the structure and logic of database queries. Successful exploitation could allow the attacker to compromise security...

CVE-2004-0035

SQL injection vulnerability in register.php for Phorum 3.4.5 and earlier allows remote attackers to execute arbitrary SQL commands via the hideemail parameter...

CVE-2004-0035

CVE-2004-0035 affects Phorum 3.4.5 and earlier, where register.php is vulnerable to SQL injection via the hide_email parameter. The underlying issue is an improper handling of user-supplied input, enabling remote attackers to execute arbitrary SQL commands. The provided documents do not specify a...

Phorum < 3.4.3 Message Post XSS

Binary data 1595.prm...

Phorum search.php subject Parameter XSS

The remote version of Phorum contains a script called 'search.php' that is vulnerable to a cross-site scripting attack. An attacker may be able to exploit this problem to steal the authentication credentials of third-party users. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...