PT-2000-2012 · Phorum · Phorum

Published 2000-12-31 · Updated 2008-09-05 · CVE-2000-1233

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Phorum version 3.0.7

Description A SQL injection issue allows remote attackers to execute arbitrary SQL queries. The issue is exploited via the sSQL parameter in scripts such as read.php3.

Recommendations For Phorum version 3.0.7, update to a newer version that contains a fix for this issue to prevent exploitation. As a temporary workaround, consider restricting access to the sSQL parameter in the affected scripts until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2000-1233

Affected Products

Phorum

References · 5

• 🔥 http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2000-1233 · Security Note
• http://digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm · Note
• http://hispahack.ccc.de/mi020.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-1233 · Note