Phorum多个跨站脚本漏洞

BUGTRAQ ID: 34551 Phorum是一款基于PHP的WEB论坛程序，可在Linux和Unix操作系统下使用，也可在Microsoft Windows操作系统下使用。 Phorum的管理控制台和文件上传模块没有正确地过滤用户所提交的请求参数，远程攻击者可以通过向论坛提交恶意的POST或GET请求执行跨站脚本攻击。 以下是include/admin/banlist.php文件中的有漏洞代码段： +++include/admin/banlist.php @@ 88:104 88 if$GET"curr" && $GET"delete" 89 90 ? 91 92 div...

Phorum < 5.2.10 Cross-Site Scripting/Request Forgery

=cicatriz [email protected]==advisories= / / / / // / / // / o / / .-/ =Phorum 5.2.10 Cross-Site Scripting/Request Forgery==/= == =Advisory & Vulnerability Information=== Title: Phorum 5.2.10 Cross-Site Scripting/Request Forgery Advisory ID: VUDO-2009-1504 Advisory URL:...

Phorum 5.2 - adminusers.php Multiple Cross-Site Scripting Vulnerabilities

Phorum 5.2 - adminusers.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/34551/info Phorum is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input. An attacker can exploit these...

Phorum 5.2 - '/admin/banlist.php?curr' Cross-Site Scripting

source: https://www.securityfocus.com/bid/34551/info Phorum is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input. An attacker can exploit these issues to steal cookie-based authentication credentials and launch other...

Phorum 5.2 - versioncheck.php?upgrade_available Cross-Site Scripting

Phorum 5.2 - versioncheck.php?upgradeavailable Cross-Site Scripting source: https://www.securityfocus.com/bid/34551/info Phorum is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input. An attacker can exploit these issue...

Phorum Cross Site Scripting / Request Forgery

=cicatriz ==advisories= / / / / // / / // / o / / .-/ =Phorum 5.2.10 Cross-Site Scripting/Request Forgery==/= == =Advisory & Vulnerability Information=== Title: Phorum 5.2.10 Cross-Site Scripting/Request Forgery Advisory ID: VUDO-2009-1504 Advisory URL: http://research.voodoo-labs.org/advisories/...

Phorum 5.2 - adminbanlist.php?curr Cross-Site Scripting

Phorum 5.2 - adminbanlist.php?curr Cross-Site Scripting source: https://www.securityfocus.com/bid/34551/info Phorum is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input. An attacker can exploit these issues to steal...

Phorum 5.2 - 'versioncheck.php?upgrade_available' Cross-Site Scripting

source: https://www.securityfocus.com/bid/34551/info Phorum is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input. An attacker can exploit these issues to steal cookie-based authentication credentials and launch other...

Phorum 5.2 - adminbadwords.php?curr Cross-Site Scripting

Phorum 5.2 - adminbadwords.php?curr Cross-Site Scripting source: https://www.securityfocus.com/bid/34551/info Phorum is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input. An attacker can exploit these issues to steal...

Phorum 5.2 - '/admin/users.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/34551/info Phorum is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input. An attacker can exploit these issues to steal cookie-based authentication credentials and launch other...

Phorum 5.2 - '/admin/badwords.php?curr' Cross-Site Scripting

source: https://www.securityfocus.com/bid/34551/info Phorum is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input. An attacker can exploit these issues to steal cookie-based authentication credentials and launch other...

Phorum Detection (HTTP)

HTTP based detection of Phorum. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.100108";...

CVE-2009-0488

Cross-site scripting XSS vulnerability in Phorum before 5.2.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in Phorum before 5.2.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-0488

Phorum (PHP-based forum software) is affected by a cross-site scripting (XSS) vulnerability in versions prior to 5.2.10. The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The NVD entry assigns a CVSSv2 base score of 4.3 (MEDIUM) with network attack ...

CVE-2009-0488

Cross-site scripting XSS vulnerability in Phorum before 5.2.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-0488: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Phorum before 5.2.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Phorum admin.php3无需验证修改管理员口令漏洞

BUGTRAQ: 2271 Phorum是一款基于PHP的WEB论坛程序，可使用在Linux和Unix操作系统下，也可使用在Microsoft Windows操作系统下。Phorum存在一个问题，远程攻击者可以访问本地系统文件。 admin.php3脚本用于安全和管理被创建的论坛。它带有口令保护，但存在漏洞可以无需访问权限修改管理员口令。一旦拥有了管理功能的访问权限，就可以进入 Master Setting 功能，在 default .langfile name 输入框输入想要访问的系统本地文件，重新载入admin.php3页面后就可以浏览这个文件的内容了。 3.0.7 and...

Phorum 3.0.x的几个安全漏洞

Phorum是用PHP编写的基于WEB的讨论组（BBS）软件。该软件包被发现存在几个安全漏洞，攻击者可以借此入侵Phorum运行的主机。 Admin.php3 Admin.php3脚本用于安全和管理被创建的论坛。它带有口令保护，但利用其漏洞可以修改口令，然后穿过所有认证程序为所欲为。 如下URL可以将管理口令修改为'flow'： http://www.example.com/admin.php3?step=4&option=pass&confirm=flow&newPssword=flow 一旦拥有了管理功能的访问权限，就可以轻易读取该httpd服务器所在主机的任何文件。进入 Maste...

Phorum violation.php3转发任意邮件漏洞

BUGTRAQ: 2272 Phorum是一款基于PHP的WEB论坛程序，可使用在Linux和Unix操作系统下，也可使用在Microsoft Windows操作系统下。Phorum存在一个漏洞允许远程用户发送任意邮件，而且不需要任何验证。 violation.php3处理URL的参数，通过主机的MTA给Mod参数指定的email发送邮件，不过要记住的是，这封电子邮件会包含攻击者的IP（或代理服务器IP）和FQDN。恶意用户可能利用这个漏洞发送垃圾邮件或邮件炸弹等行径，可能让WEB主机的IP被加入垃圾邮件服务器的黑名单。 3.0.7 and Previous Brian Moon...