PT-2000-2013 · Phorum · Phorum

Published 2000-12-31 · Updated 2008-09-05 · CVE-2000-1234

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Phorum version 3.0.7

Description The issue allows remote attackers to send e-mails to arbitrary addresses, potentially using Phorum as a spam proxy. This is achieved by setting the Mod and ForumName parameters in the violation.php3 file.

Recommendations For Phorum version 3.0.7, consider restricting access to the violation.php3 file to prevent unauthorized use, and avoid using the Mod and ForumName parameters in this context until a fix is available.

Exploit

Fix

Related Identifiers

CVE-2000-1234

Affected Products

Phorum

References · 7

• 🔥 http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html · Exploit
• 🔥 https://exploit-db.com/exploits/20587 · Exploit
• 🔥 http://securityfocus.com/bid/2272 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2000-1234 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-1234 · Note
• http://digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm · Note
• http://hispahack.ccc.de/mi020.html · Note