PT-2000-2007 · Phorum · Phorum

Published 2000-12-31 · Updated 2008-09-05 · CVE-2000-1228

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Phorum version 3.0.7

Description The issue allows remote attackers to change the administrator password without authentication. This is achieved by sending an HTTP request for "admin.php3" that sets the step, option, confirm, and newPssword variables.

Recommendations For Phorum version 3.0.7, update to a newer version that contains a fix for this issue, as using the current version allows unauthorized password changes. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2000-1228

Affected Products

Phorum

References · 7

• 🔥 https://exploit-db.com/exploits/20586 · Exploit
• 🔥 http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html · Exploit
• 🔥 http://securityfocus.com/bid/2271 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2000-1228 · Security Note
• http://digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm · Note
• http://hispahack.ccc.de/mi020.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-1228 · Note