Sploitus

34 exploited vulnerabilities in Phorum

Vulnerabilities with publicly known exploits

Vendors
Phorum
With known exploits
34
Affected Phorum versions
≤ 5.1.20, 3.2.11, 5.1.13, 3.1, 3.1.1, 3.1.1_pre, 3.1.1_rc2, 3.1.1a, 3.1.2, 3.2, 3.2.2, 3.2.3, 3.2.3a, 3.2.3b, 3.2.4, 3.2.5, 3.2.6, 3.2.7, 3.2.8, 3.3.1, 3.3.1a, 3.3.2, 3.3.2a, 3.3.2b3, 3.4, 3.4.1, 3.4.2, 3.4.3, 3.4.4, 3.4.5, 3.4.6, 3.4.7, 3.4.8, 3.4.8a, 5.0.3_beta, 5.0.7_beta, 5.0.9, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.0.14, 5.1.14, 3.0.7, 4.3.7, 5.0.0_alpha, 5.0.1_alpha, 5.0.2_alpha, 5.0.4_beta, 5.0.4a_beta, 5.0.14a, 5.2.18, 5.2, 5.2.1, 5.2.10, 5.2.11, 5.2.12, 5.2.13, 5.2.14, 5.2.15, 5.2.16, 5.1.21

Vulnerabilities with exploits

Highest CVSS first — 20 of these already have exploit code on Sploitus

CVE-2007-2339 3 exploits
CVSS 7.5 HIGH 2007-04-27FIX AVAILABLE
Phorum 5.1.20 - 'pm.php' Recipient Name SQL InjectionPhorum 5.1.20 - 'admin.php' badwords/banlist Module SQL Injection
CVE-2007-2338 1 exploit
CVSS 7.5 HIGH 2007-04-27FIX AVAILABLE
Phorum 5.1.20 - '/include/admin/banlist.php?delete' Cross-Site Request Forgery Banlist Deletion
CVE-2006-6550 1 exploit
CVSS 7.5 HIGH 2006-12-14
Phorum 3.2.11 - 'common.php' Remote File Inclusion
CVE-2006-3053 1 exploit
CVSS 7.5 HIGH 2006-06-16
PHORUM 3.x/5.x - 'Common.php' Remote File Inclusion
CVE-2004-2240
CVSS 7.5 HIGH 2004-12-31FIX AVAILABLE
CVE-2004-1938 1 exploit
CVSS 7.5 HIGH 2004-04-19FIX AVAILABLE
Phorum 3.4.x - Phorum_URIAuth SQL Injection
CVE-2003-1466
CVSS 7.5 HIGH 2003-12-31FIX AVAILABLE
CVE-2002-0764 1 exploit
CVSS 7.5 HIGH 2002-07-26FIX AVAILABLE
Phorum 3.3.2a - Remote Command Execution
CVE-2000-1233
CVSS 7.5 HIGH 2000-12-31FIX AVAILABLE
CVE-2005-3543
CVSS 6.8 MEDIUM 2005-11-16FIX AVAILABLE
CVE-2003-0283 1 exploit
CVSS 6.8 MEDIUM 2003-05-14FIX AVAILABLE
Phorum 3.4.x - 'Message Form' HTML Injection
CVE-2007-2249 1 exploit
CVSS 6.5 MEDIUM 2007-04-25FIX AVAILABLE
Phorum 5.1.20 - '/include/controlcenter/users.php' Multiple Method Privilege Escalations
CVE-2006-3611 1 exploit
CVSS 5.5 MEDIUM 2006-07-14
Phorum 5 - 'pm.php' Arbitrary Local Inclusion
CVE-2007-2250 1 exploit
CVSS 5.0 MEDIUM 2007-04-25FIX AVAILABLE
Phorum 5.1.20 - 'admin.php?module[]' Full Path Disclosure
CVE-2005-0843 1 exploit
CVSS 5.0 MEDIUM 2005-03-24FIX AVAILABLE
Phorum 3.x/5.0.x - HTTP Response Splitting
CVE-2003-1465
CVSS 5.0 MEDIUM 2003-12-31FIX AVAILABLE
CVE-2000-1234 1 exploit
CVSS 5.0 MEDIUM 2000-12-31FIX AVAILABLE
Phorum 3.0.7 - 'violation.php3' Arbitrary Email Relay
CVE-2000-1232
CVSS 5.0 MEDIUM 2000-12-31
CVE-2000-1231
CVSS 5.0 MEDIUM 2000-12-31FIX AVAILABLE
CVE-2000-1230 1 exploit
CVSS 5.0 MEDIUM 2000-12-31FIX AVAILABLE
Phorum 3.0.7 - 'auth.php3' Backdoor Access
CVE-2000-1229
CVSS 5.0 MEDIUM 2000-12-31FIX AVAILABLE
CVE-2000-1228 1 exploit
CVSS 5.0 MEDIUM 2000-12-31
Phorum 3.0.7 - 'admin.php3' Unverified Administrative Password Change
CVE-2004-1518
CVSS 4.6 MEDIUM 2004-12-31
CVE-2012-4234 3 exploits
CVSS 4.3 MEDIUM 2014-09-04FIX AVAILABLE
Phorum 5.2.18 Cross Site ScriptingPhorum 5.2.18 Cross Site Scripting
CVE-2011-4561 1 exploit
CVSS 4.3 MEDIUM 2011-11-28
Phorum 5.2.18 - '/admin/index.php' Cross-Site Scripting
CVE-2008-4513
CVSS 4.3 MEDIUM 2008-10-09FIX AVAILABLE
CVE-2007-2248 2 exploits
CVSS 4.3 MEDIUM 2007-04-25FIX AVAILABLE
Phorum 5.1.20 - 'admin.php?Groups Module group_id' Cross-Site ScriptingPhorum 5.1.20 - 'admin.php?modsettings Module smiley_id' Cross-Site Scripting
CVE-2005-2836
CVSS 4.3 MEDIUM 2005-09-07FIX AVAILABLE
CVE-2005-0784
CVSS 4.3 MEDIUM 2005-03-20FIX AVAILABLE
CVE-2005-0783 1 exploit
CVSS 4.3 MEDIUM 2005-03-20FIX AVAILABLE
Phorum 5.0.14 - Multiple Subject and Attachment HTML Injection Vulnerabilities
CVE-2004-2242 1 exploit
CVSS 4.3 MEDIUM 2004-12-31FIX AVAILABLE
Phorum 5.0.7 - Search Script Cross-Site Scripting
CVE-2004-2241
CVSS 4.3 MEDIUM 2004-12-31FIX AVAILABLE
CVE-2004-1822 3 exploits
CVSS 4.3 MEDIUM 2004-03-15
Phorum 3.x - 'register.php' HTTP_REFERER Cross-Site ScriptingPhorum 3.x - 'login.php' HTTP_REFERER Cross-Site Scripting
CVE-2002-2340
CVSS 4.3 MEDIUM 2002-12-31FIX AVAILABLE