PHP Phorum quick fix

The major problem in Phorum, if all else is secured with the admin area off limits to anyone, seems to be the reading of local server files. In that last email on this in the correspondance part you can see the following... snip Hi jason, The fix that is provided in Phorum's site doesn't...

Security problems with Phorum php message board

Author: Brian Moon Homepage: www.phorum.org Version: 3.2.6 Problem: Any user can parse a choosed php script file using the Phorum sustem. It is also possibel, under certain circunstances, to execute arbitrary commands on the server as the httpd user. Status: Fixed in version 3.2.7 released...

Phorum 3.x - Arbitrary File Read

Phorum 3.x - Arbitrary File Read source: https://www.securityfocus.com/bid/1997/info Phorum is a PHP based web forums package. Due to an error in the handling of user input in administrative scripts, any user can view the any file readable by the webserver on the target host. This is due to...

Phorum 3.x - Arbitrary File Read

source: https://www.securityfocus.com/bid/1997/info Phorum is a PHP based web forums package. Due to an error in the handling of user input in administrative scripts, any user can view the any file readable by the webserver on the target host. This is due to user-supplied input being referenced a...

Phorum 3.x - PHP Configuration Disclosure

Phorum 3.x - PHP Configuration Disclosure source: https://www.securityfocus.com/bid/1985/info Phorum is a PHP based web forums package. Due to an error in the implementation of forum selection in administrative scripts, any user can view the any PHP script on the target host. This is due to...

Phorum 3.x - PHP Configuration Disclosure

source: https://www.securityfocus.com/bid/1985/info Phorum is a PHP based web forums package. Due to an error in the implementation of forum selection in administrative scripts, any user can view the any PHP script on the target host. This is due to user-supplied input being referenced as a...

Phorum 3.0.7 - admin.php3 Unverified Administrative Password Change

Phorum 3.0.7 - admin.php3 Unverified Administrative Password Change source: https://www.securityfocus.com/bid/2271/info Phorum is a popular, free, open source software package originally written by Brian Moon. The package is designed to add chat/bulletin board style interaction between visitors o...

Phorum 3.0.7 - auth.php3 Backdoor Access

Phorum 3.0.7 - auth.php3 Backdoor Access source: https://www.securityfocus.com/bid/2274/info Phorum is a freely available, open source, popular WWW Board written by Brian Moon. It is designed to enhance the services offered on a web page, allow users to interact with one another through bulletin...

Phorum 3.0.7 - 'auth.php3' Backdoor Access

source: https://www.securityfocus.com/bid/2274/info Phorum is a freely available, open source, popular WWW Board written by Brian Moon. It is designed to enhance the services offered on a web page, allow users to interact with one another through bulletin board chat and discussion. A problem with...

Phorum 3.0.7 - 'admin.php3' Unverified Administrative Password Change

source: https://www.securityfocus.com/bid/2271/info Phorum is a popular, free, open source software package originally written by Brian Moon. The package is designed to add chat/bulletin board style interaction between visitors of a web site. A problem with Phorum can allow remote users access to...

Phorum 3.0.7 - violation.php3 Arbitrary Email Relay

Phorum 3.0.7 - violation.php3 Arbitrary Email Relay source: https://www.securityfocus.com/bid/2272/info Phorum is a freely available, open source package originally written by Brian Moon. The package is designed to add enhanced features to a web page, allowing users to interact through bulletin...

Phorum 3.0.7 - 'violation.php3' Arbitrary Email Relay

source: https://www.securityfocus.com/bid/2272/info Phorum is a freely available, open source package originally written by Brian Moon. The package is designed to add enhanced features to a web page, allowing users to interact through bulletin board style chats forums and discussions. A problem...