Phorum 5.2 versioncheck.php upgrade_available Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/34551/info Phorum is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input. An attacker can exploit these issues to steal cookie-based...

Phorum 3.4 Email Subject Line Script Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/7262/info It has been reported that it is possible to inject script code into the subject of a message in Phorum. This may be done by constructing a malicious subject line or other fields before sending an email to the...

phorum5114.txt

Phorum 5.1.14 http://www.phorum.org -------------------------- Cross Site Scripting XSS -------------------------- POST http://target.xx:80/posting.php HTTP/1.0 Accept: / Content-Type: application/x-www-form-urlencoded Host: target.xx Content-Length: 447...

Multiple Vulnerabilities in Phorum 3.4.5

Phorum 3.4.5 Vulnerabilities ----------------------------- Credit: Author: : Calum Power Versions : = 3.4.5 Vendor : Phorum Vendor URL : http://phorum.org Vendor Contacted: Yes Vendor Fix: Phorum has released Phorum v3.4.6 as a response to this advisory. Please patch your vulnerable software ASAP...

A Phorum's bug...

Hi! I have founded a bug in Phorum http://phorum.org/. It is possible to inject script code or other html-tag into "subject", "author's name" or "author's e-mail" of a message in Phorum. In the subject name, e-mail input of message you need to write any html-tag like this:...

CVE-2000-1230

Backdoor in auth.php3 in Phorum 3.0.7 allows remote attackers to access restricted web pages via an HTTP request with the PHPAUTHUSER parameter set to "boogieman"...

Security problems with Phorum php message board

Author: Brian Moon Homepage: www.phorum.org Version: 3.2.6 Problem: Any user can parse a choosed php script file using the Phorum sustem. It is also possibel, under certain circunstances, to execute arbitrary commands on the server as the httpd user. Status: Fixed in version 3.2.7 released...