PT-2003-2432 · Phorum · Phorum

Webmaster · Published 2003-12-31 · Updated 2017-07-29 · CVE-2003-1487

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Phorum versions 3.4 through 3.4.2

Description The issue allows remote attackers to execute arbitrary commands and modify configuration files. This can be achieved via the UserAdmin program, Edit user profile, or stats program.

Recommendations For Phorum versions 3.4 through 3.4.2, consider disabling the UserAdmin program, Edit user profile, and stats program until a patch is available to prevent command injection attacks. Restrict access to these components to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2003-1487

Affected Products

Phorum

References · 8

• http://securityfocus.com/bid/7574 · Patch
• http://securityfocus.com/bid/7578 · Patch
• http://securityfocus.com/bid/7579 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2003-1487 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/12500 · Note
• http://securityfocus.com/archive/1/321310 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1487 · Note
• http://securityreason.com/securityalert/3288 · Note