CVE-2003-0283: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Phorum before 3.4.3 allows remote attackers to inject arbitrary web script and HTML tags via a message with a "" before a tag name in the 1 subject, 2 author's name, or 3 author's e-mail...

Phorum Vulnerabilities

Phorum.org have acknowledged the flaws below and have released version 3.4.3 which corrects them. 1 The Phorum download program download.php is vulnerable to directory transversal attack and is able to read arbitrary files from anywhere within the root directory - with permissions of the web...

A Phorum's bug...

Hi! I have founded a bug in Phorum http://phorum.org/. It is possible to inject script code or other html-tag into "subject", "author's name" or "author's e-mail" of a message in Phorum. In the subject name, e-mail input of message you need to write any html-tag like this:...

Phorum 3.4.x - Message Form HTML Injection

Phorum 3.4.x - Message Form HTML Injection source: https://www.securityfocus.com/bid/7545/info An HTML injection issue has been reported which may lead to unauthorized code execution. It has been reported that it is possible to inject HTML or script code into the subject and other fields of a...

Phorum 3.4.x - 'Message Form' HTML Injection

source: https://www.securityfocus.com/bid/7545/info An HTML injection issue has been reported which may lead to unauthorized code execution. It has been reported that it is possible to inject HTML or script code into the subject and other fields of a message in Phorum. This may be done by includi...

Phorum 3.4 Cross Site Scripting

Description: It is possible to insert javascript code in a message and execute it. 1. go to a phorum 2. click on new topic 3. enter any name 4. enter any email 5. enter a title in the way like this "scriptalert "Vulnerable";/script 6. enter any text 7. click the preview button 8. click the send...

Phorum 3.4 - Email Subject Line Script Injection

Phorum 3.4 - Email Subject Line Script Injection source: https://www.securityfocus.com/bid/7262/info It has been reported that it is possible to inject script code into the subject of a message in Phorum. This may be done by constructing a malicious subject line or other fields before sending an...

Phorum 3.4 - Email Subject Line Script Injection

source: https://www.securityfocus.com/bid/7262/info It has been reported that it is possible to inject script code into the subject of a message in Phorum. This may be done by constructing a malicious subject line or other fields before sending an email to the target victim. "alert"Vulnerable";...

CVE-2002-2340

Cross-site scripting XSS vulnerability in read.php in Phorum 3.3.2a allows remote attackers to inject arbitrary web script or HTML via 1 the t parameter or 2 the body of an email response...

CVE-2002-0764

Phorum 3.3.2a allows remote attackers to execute arbitrary commands via an HTTP request to 1 plugin.php, 2 admin.php, or 3 del.php that modifies the PHORUMsettingsdir variable to point to a directory that contains a PHP file with the commands...

CVE-2002-0764

Phorum 3.3.2a is vulnerable to a remote command execution via HTTP requests to (1) plugin.php, (2) admin.php, or (3) del.php. The attack modifies the PHORUM[settings_dir] setting to point to a directory containing a PHP file with the attacker’s commands, enabling remote code execution. The NVD/CV...

CVE-2002-0764

Phorum 3.3.2a allows remote attackers to execute arbitrary commands via an HTTP request to 1 plugin.php, 2 admin.php, or 3 del.php that modifies the PHORUMsettingsdir variable to point to a directory that contains a PHP file with the commands...

CVE-2002-0764: Undefined Security Weakness

Phorum 3.3.2a allows remote attackers to execute arbitrary commands via an HTTP request to 1 plugin.php, 2 admin.php, or 3 del.php that modifies the PHORUMsettingsdir variable to point to a directory that contains a PHP file with the commands...

CVE-2002-0352

Phorum 3.3.2 allows remote attackers to determine the email addresses of the 10 most active users via a direct HTTP request to the stats.php program, which does not require authentication...

Phorum 3.3.2 - Cross-Site Scripting

source: https://www.securityfocus.com/bid/4767/info Phorum is a PHP based web forums package designed for most UNIX variants, Linux, and Microsoft Windows operating systems. The 'header.php' and 'footer.php' components of Phorum do not santize the client-supplied value of the 'GLOBALS' parameter...

Phorum 3.3.2a has another bug for remote command execution

Target: Phorum 3.3.2a maybee older Description: Phorum 3.3.2a let's remote users execute arbitary code Found by: Markus [email protected] Vendor: http://www.phorum.org Notified Vendor: Yes, already fixed in 3.3.2b Details: Another bug for remote command execution. This time it's...

Phorum 3.3.2 - Cross-Site Scripting

Phorum 3.3.2 - Cross-Site Scripting source: https://www.securityfocus.com/bid/4767/info Phorum is a PHP based web forums package designed for most UNIX variants, Linux, and Microsoft Windows operating systems. The 'header.php' and 'footer.php' components of Phorum do not santize the client-suppli...

Phorum 3.3.2a remote command execution

Target: Phorum 3.3.2a prior versions? Description: In Phorum 3.3.2a a bulletin board there's a security flaw that lets remote users include external php scripts and execute arbitary code. Found by: Markus [email protected] Vendor: http://www.phorum.org Notified Vendor: Yes, already fixed...

Phorum 3.3.2a - Remote Command Execution

source: https://www.securityfocus.com/bid/4763/info Phorum is a PHP based web forums package designed for most UNIX variants, Linux, and Microsoft Windows operating systems. A vulnerability has been reported in Phorum that will allow remote attackers to specify external PHP scripts and potentiall...

Phorum 3.3.2a - Remote Command Execution

Phorum 3.3.2a - Remote Command Execution source: https://www.securityfocus.com/bid/4763/info Phorum is a PHP based web forums package designed for most UNIX variants, Linux, and Microsoft Windows operating systems. A vulnerability has been reported in Phorum that will allow remote attackers to...