CVE-2004-2243: Undefined Security Weakness

Phorum allows remote attackers to hijack sessions of other users by stealing and replaying the session hash in the phorumuriauth parameter, as demonstrated using profile.php. NOTE: the affected version was reported to be 4.3.7, but this may be erroneous...

CVE-2004-2241: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Phorum 5.0.11 and earlier allows remote attackers to inject arbitrary HTML or web script via search.php. NOTE: some sources have reported that the affected file is read.php, but this is inconsistent with the vendor's patch...

CVE-2000-1231

code.php3 in Phorum 3.0.7 allows remote attackers to read arbitrary files in the phorum directory via the query string...

CVE-2000-1234

CVE-2000-1234: In Phorum 3.0.7, violation.php3 can be abused by remote attackers to send email to arbitrary addresses and possibly turn Phorum into a spam proxy by manipulating Mod and ForumName parameters. Affected: Phorum 3.0.7. Root cause: parameter handling in violation.php3 that enables emai...

CVE-2000-1228

Phorum 3.0.7 allows remote attackers to change the administrator password without authentication via an HTTP request for admin.php3 that sets step, option, confirm and newPssword variables...

CVE-2000-1232

upgrade.php3 in Phorum 3.0.7 could allow remote attackers to modify certain Phorum database tables via an unknown method...

CVE-2000-1229

Directory traversal vulnerability in Phorum 3.0.7 allows remote Phorum administrators to read arbitrary files via ".." dot dot sequences in the default .langfile name field in the Master Settings administrative function, which causes the file to be displayed in admin.php3...

CVE-2000-1233

SQL injection vulnerability in read.php3 and other scripts in Phorum 3.0.7 allows remote attackers to execute arbitrary SQL queries via the sSQL parameter...

CVE-2000-1232

The CVE-2000-1232 entry concerns Phorum 3.0.7, where upgrade.php3 could allow remote attackers to modify certain Phorum database tables via an unknown method. The connected documents confirm the affected product/version and the basic impact (unauthorized modification of database tables), but they...

CVE-2000-1228

CVE-2000-1228 affects Phorum 3.0.7. An unauthenticated remote attacker can change the administrator password by sending an HTTP request to admin.php3 that sets the variables step, option, confirm and newPssword. The description across sources corroborates that user authentication is bypassed to a...

CVE-2000-1233

Phorum 3.0.7 contains a SQL injection vulnerability in read.php3 and other scripts that allows remote attackers to inject arbitrary SQL via the sSQL parameter. Affected component: Phorum 3.0.7 scripts; root cause: unsafely interpolated sSQL input leading to SQL query manipulation. Impact is descr...

CVE-2000-1229

Phorum 3.0.7 is affected by a directory traversal vulnerability that allows remote Phorum administrators to read arbitrary files via dot-dot sequences in the default .langfile name field in the Master Settings admin function, causing the file to be displayed in admin.php3. The issue stems from im...

CVE-2000-1230

The CVE-2000-1230 entry concerns Phorum 3.0.7, where a backdoor in auth.php3 allows remote attackers to access restricted web pages by sending an HTTP request with the PHP_AUTH_USER parameter set to boogieman. This describes a vulnerable component (auth.php3) and a clear attack vector (HTTP-based...

CVE-2000-1234

violation.php3 in Phorum 3.0.7 allows remote attackers to send e-mails to arbitrary addresses and possibly use Phorum as a "spam proxy" by setting the Mod and ForumName parameters...

CVE-2000-1230

Backdoor in auth.php3 in Phorum 3.0.7 allows remote attackers to access restricted web pages via an HTTP request with the PHPAUTHUSER parameter set to "boogieman"...

CVE-2000-1231

The CVE describes a vulnerability in Phorum 3.0.7 where code.php3 allows remote attackers to read arbitrary files within the Phorum directory via the query string. The affected software is Phorum 3.0.7; the vulnerable component is the code.php3 execution path that mishandles query strings, enabli...

CVE-2004-2110

CVE-2004-2110 affects Phorum prior to 3.4.6, where register.php is vulnerable to SQL injection via the hide_email parameter. The underlying issue is unsafely constructed SQL in the registration flow, allowing remote attackers to execute arbitrary SQL commands. The NVD assessment assigns a base sc...

CVE-2004-2110

SQL injection vulnerability in register.php in Phorum before 3.4.6 allows remote attackers to execute arbitrary SQL commands via the hideemail parameter...

CVE-2004-2110: Undefined Security Weakness

SQL injection vulnerability in register.php in Phorum before 3.4.6 allows remote attackers to execute arbitrary SQL commands via the hideemail parameter...

CVE-2004-1938

This CVE (CVE-2004-1938) concerns a SQL injection in Phorum 3.4.7’s userlogin.php. The vulnerability is triggered by doubly hex-encoded input (e.g., "%2527" which becomes a single quote) via the phorum_uriauth parameter to list.php, allowing remote attackers to execute arbitrary SQL commands. The...