CVE-2002-0764

Phorum 3.3.2a is vulnerable to a remote command execution via HTTP requests to (1) plugin.php, (2) admin.php, or (3) del.php. The attack modifies the PHORUM[settings_dir] setting to point to a directory containing a PHP file with the attacker’s commands, enabling remote code execution. The NVD/CV...

CVE-2002-0352

Phorum 3.3.2 allows remote attackers to determine the email addresses of the 10 most active users via a direct HTTP request to the stats.php program, which does not require authentication...

Phorum 3.3.2a has another bug for remote command execution

Target: Phorum 3.3.2a maybee older Description: Phorum 3.3.2a let's remote users execute arbitary code Found by: Markus [email protected] Vendor: http://www.phorum.org Notified Vendor: Yes, already fixed in 3.3.2b Details: Another bug for remote command execution. This time it's...

Phorum 3.3.2a remote command execution

Target: Phorum 3.3.2a prior versions? Description: In Phorum 3.3.2a a bulletin board there's a security flaw that lets remote users include external php scripts and execute arbitary code. Found by: Markus [email protected] Vendor: http://www.phorum.org Notified Vendor: Yes, already fixed...

Phorum 3.3.2 - Cross-Site Scripting

Phorum 3.3.2 - Cross-Site Scripting source: https://www.securityfocus.com/bid/4767/info Phorum is a PHP based web forums package designed for most UNIX variants, Linux, and Microsoft Windows operating systems. The 'header.php' and 'footer.php' components of Phorum do not santize the client-suppli...

Phorum 3.3.2 - Cross-Site Scripting

source: https://www.securityfocus.com/bid/4767/info Phorum is a PHP based web forums package designed for most UNIX variants, Linux, and Microsoft Windows operating systems. The 'header.php' and 'footer.php' components of Phorum do not santize the client-supplied value of the 'GLOBALS' parameter...

Phorum 3.3.2a - Remote Command Execution

Phorum 3.3.2a - Remote Command Execution source: https://www.securityfocus.com/bid/4763/info Phorum is a PHP based web forums package designed for most UNIX variants, Linux, and Microsoft Windows operating systems. A vulnerability has been reported in Phorum that will allow remote attackers to...

Phorum 3.3.2a - Remote Command Execution

source: https://www.securityfocus.com/bid/4763/info Phorum is a PHP based web forums package designed for most UNIX variants, Linux, and Microsoft Windows operating systems. A vulnerability has been reported in Phorum that will allow remote attackers to specify external PHP scripts and potentiall...

CVE-2002-0352

Phorum 3.3.2 allows remote attackers to determine the email addresses of the 10 most active users via a direct HTTP request to the stats.php program, which does not require authentication...

CVE-2002-0352

Phorum 3.3.2 is vulnerable to an information-disclosure issue in stats.php that allows remote attackers to determine the email addresses of the 10 most active users via an unauthenticated direct HTTP request. The root cause is the lack of authentication for stats.php, enabling access to user-iden...

Дырки в PHP Phorum

Можно указать некорректный php-файл для выполнения, администратор форума имеет возможность вставить собственный PHP-скрипт...

Phorum Discussion Board Security Bug (Email Disclosure)

Concerning latest Phorum version 3.3.2 A bug in the PHP based forum script Phorum makes it possible to obtain the email addresses of the 10 most active users. In the 'admin/' directory of the forum there is a script called 'stats.php' that allows administrators and anyone else, since there is no...

Phorum common.php ForumLang Parameter Traversal Arbitrary File Access

The version of Phorum installed on the remote host lets an attacker read arbitrary files on the affected host with the privileges of the http daemon because it fails to filter input to the 'ForumLang' parameter of the 'support/common.php' script of directory traversal sequences. %NASLMINLEVEL 703...

CVE-2000-1234

violation.php3 in Phorum 3.0.7 allows remote attackers to send e-mails to arbitrary addresses and possibly use Phorum as a "spam proxy" by setting the Mod and ForumName parameters...

CVE-2000-1228

Phorum 3.0.7 allows remote attackers to change the administrator password without authentication via an HTTP request for admin.php3 that sets step, option, confirm and newPssword variables...

CVE-2000-1231

code.php3 in Phorum 3.0.7 allows remote attackers to read arbitrary files in the phorum directory via the query string...

CVE-2000-1232

upgrade.php3 in Phorum 3.0.7 could allow remote attackers to modify certain Phorum database tables via an unknown method...

CVE-2000-1229

Directory traversal vulnerability in Phorum 3.0.7 allows remote Phorum administrators to read arbitrary files via ".." dot dot sequences in the default .langfile name field in the Master Settings administrative function, which causes the file to be displayed in admin.php3...

CVE-2000-1230

Backdoor in auth.php3 in Phorum 3.0.7 allows remote attackers to access restricted web pages via an HTTP request with the PHPAUTHUSER parameter set to "boogieman"...

CVE-2000-1233

SQL injection vulnerability in read.php3 and other scripts in Phorum 3.0.7 allows remote attackers to execute arbitrary SQL queries via the sSQL parameter...