PT-2004-1250 · Phorum · Phorum

Published 2004-01-20 · Updated 2017-10-10 · CVE-2004-0035

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Phorum versions 3.4.5 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the hide email parameter in the register.php file.

Recommendations For Phorum versions 3.4.5 and earlier, update to a version later than 3.4.5 to resolve the issue.

Fix

Related Identifiers

CVE-2004-0035

Affected Products

Phorum

References · 7

• http://securityfocus.com/bid/9363 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0035 · Security Note
• http://secunia.com/advisories/10567 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0035 · Note
• http://osvdb.org/3508 · Note
• http://marc.info/?l=bugtraq&m=107340481804110&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/14146 · Note