PT-2000-2007 · Phorum · Phorum

Publicado 2000-12-31 · Atualizado 2008-09-05 · CVE-2000-1228

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Phorum version 3.0.7

Description The issue allows remote attackers to change the administrator password without authentication. This is achieved by sending an HTTP request for "admin.php3" that sets the step, option, confirm, and newPssword variables.

Recommendations For Phorum version 3.0.7, update to a newer version that contains a fix for this issue, as using the current version allows unauthorized password changes. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2000-1228

Produtos afetados

Phorum

Referências · 7

• 🔥 https://exploit-db.com/exploits/20586 · Exploit
• 🔥 http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html · Exploit
• 🔥 http://securityfocus.com/bid/2271 · Exploit
• http://digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm · Nota
• http://hispahack.ccc.de/mi020.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-1228 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2000-1228 · Nota de Segurança