M-Phorum Cross Site Scripting

------------------------------------------------------------------------------------- M-Phorum Cross Site Scripting Site:http://m-phorum.sourceforge.net/site/ Credit : CodeXpLoder'tq webpage:www.biyosecurity.com Mail :[email protected]...

PHORUM 3.x/5.x - 'Common.php' Remote File Inclusion

source: https://www.securityfocus.com/bid/16977/info The PHORUM application is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this issue to include an arbitrary remote file containin...

PHORUM 3.x5.x - Common.php Remote File Inclusion

PHORUM 3.x5.x - Common.php Remote File Inclusion source: https://www.securityfocus.com/bid/16977/info The PHORUM application is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this...

CVE-2005-3543

SQL injection vulnerability in search.php in Phorum 5.0.0alpha through 5.0.20, when registerglobals is enabled, allows remote attackers to execute arbitrary SQL commands via the forumids parameter...

CVE-2005-3543

SQL injection vulnerability in search.php in Phorum 5.0.0alpha through 5.0.20, when registerglobals is enabled, allows remote attackers to execute arbitrary SQL commands via the forumids parameter...

CVE-2005-3543

CVE-2005-3543 : SQL injection in Phorum web forum software via search.php (versions 5.0.0alpha–5.0.20) when register_globals is enabled. The vulnerability allows remote attackers to modify/exfiltrate data by injecting SQL through the forum_ids parameter. Affected: Phorum 5.0.0alpha up to 5.0.20. ...

waraxe-2005-SA043.txt

================================================================================ waraxe-2005-SA043 ================================================================================ Sql injection in Phorum 5.0.20 and earlier...

[waraxe-2005-SA#043] - Sql injection in Phorum 5.0.20 and earlier

================================================================================ waraxe-2005-SA043 ================================================================================ Sql injection in Phorum 5.0.20 and earlier...

CVE-2005-2836

Multiple cross-site scripting XSS vulnerabilities in Phorum 5.0.17a and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the username parameter to register.php or 2 a signature of a logged-in user in "My Control Center," which is not properly handled by control.php...

CVE-2005-2836

CVE-2005-2836 affects Phorum versions up to 5.0.17a. The vuln arises from cross-site scripting in two input points: (1) the username field in register.php and (2) a signed-in user’s signature shown in “My Control Center,” not properly sanitized by control.php. The result is remote injection of sc...

Phorum < 5.0.18 register.php XSS

Binary data 3203.prm...

Phorum register.php Username Field XSS

The remote version of Phorum contains a script called 'register.php' which is vulnerable to a cross-site scripting attack. An attacker may exploit this problem to steal the authentication credentials of third party users. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

phorum5x.txt

======================================================================================= XOR Crew :: Security Advisory 9/1/2005 ======================================================================================= Phorum 5.x Multiple XSS and Session Hijacking Vulnerabilities...

CVE-2004-2242

Phorum contains a cross-site scripting vulnerability in search.php, exploitable via the subject parameter, potentially affecting Phorum 5.0.7 beta and earlier. The issue allows remote attackers to inject arbitrary HTML/JS. The public records describe the vulnerability but do not provide a concret...

CVE-2004-2243

Phorum allows remote attackers to hijack sessions of other users by stealing and replaying the session hash in the phorumuriauth parameter, as demonstrated using profile.php. NOTE: the affected version was reported to be 4.3.7, but this may be erroneous...

CVE-2004-2243

CVE-2004-2243 affects Phorum where remote attackers can hijack other users’ sessions by stealing and replaying the session hash in the phorum_uriauth parameter (demonstrated via profile.php). The note says the affected version was reported as 4.3.7, but this may be erroneous. No explicit remediat...

CVE-2004-2242

Cross-site scripting XSS vulnerability in search.php in Phorum, possibly 5.0.7 beta and earlier, allows remote attackers to inject arbitrary HTML or web script via the subject parameter...

CVE-2004-2240

Phorum 5.0.11 and earlier contains multiple SQL injection vulnerabilities. Specifically, remote attackers can modify SQL statements via (1) the query string in read.php or (2) unknown vectors in file.php. The connected sources confirm the affected product/version and the injection paths, but do n...

CVE-2004-2240

Multiple SQL injection vulnerabilities in Phorum 5.0.11 and earlier allow remote attackers to modify SQL statements via 1 the query string in read.php or 2 unknown vectors in file.php...

CVE-2004-2241

Cross-site scripting XSS vulnerability in Phorum 5.0.11 and earlier allows remote attackers to inject arbitrary HTML or web script via search.php. NOTE: some sources have reported that the affected file is read.php, but this is inconsistent with the vendor's patch...