CVSS: 7.5EPSS: 5%CPEs: 1EXPL: 1CVE-2006-6550 – Phorum 3.2.11 - 'common.php' Remote File Inclusion
https://notcve.org/view.php?id=CVE-2006-6550
PHP remote file inclusion vulnerability in common.php in Phorum 3.2.11 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the db_file parameter. NOTE: CVE disputes this vulnerability because db_file is defined before use ** IMPUGNADO ** Vulnerabilidad de inclusión remota de archivo en PHP en common.php de Phorum 3.2.11 y versiones anteriores, permite a atacantes remotos ejecutar código PHP de su elección mediante una URL en el parámetro db_file. NOTA: CVE impugan esta vulnerabilidad porque db_file se define antes de ser usada. • https://www.exploit-db.com/exploits/2894 https://exchange.xforce.ibmcloud.com/vulnerabilities/30741 •
CVSS: 5.5EPSS: 0%CPEs: 62EXPL: 2CVE-2006-3611 – Phorum 5 - 'pm.php' Arbitrary Local Inclusion
https://notcve.org/view.php?id=CVE-2006-3611
Directory traversal vulnerability in pm.php in Phorum 5 allows remote authenticated users to include and execute arbitrary local files via directory traversal sequences in the GLOBALS[template] parameter, as demonstrated by injecting PHP sequences into a log file, which is then included by pm.php. Vulnerabilidad de salto de directorio en pm.php de Phorum 5 permite a atacantes remotos autenticados incluir y ejecutar ficheros locales mediante secuencias de salto de directorio en el parámetro GLOBALS[template], como ha sido demostrado inyectando secuencias PHP en un fichero de log, el cual cual es incluido por pm.php. • https://www.exploit-db.com/exploits/2008 http://retrogod.altervista.org/phorum5_local_incl_xpl.html http://www.phorum.org/phorum5/read.php?14%2C114358 http://www.securityfocus.com/archive/1/439976/100/0/threaded http://www.vupen.com/english/advisories/2006/2794 •
CVSS: 2.6EPSS: 0%CPEs: 1EXPL: 0CVE-2006-3612
https://notcve.org/view.php?id=CVE-2006-3612
Cross-site scripting (XSS) vulnerability in Phorum 5.1.14 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Phorum 5.1.14 permite a atacantes remotos inyectar secuencias de comando web o HTML a través de vectores no especificados. • http://www.phorum.org/phorum5/read.php?14%2C114358 •
CVSS: 5.1EPSS: 5%CPEs: 1EXPL: 0CVE-2006-3615
https://notcve.org/view.php?id=CVE-2006-3615
Multiple PHP remote file inclusion vulnerabilities in Phorum 5.1.14, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via unspecified vectors related to an uninitialized variable. Múltiples vulnerabilidades de inclusión remota de archivo en PHP en Phorum 5.1.14, cuando register_globals está activado, permite a atacantes remotos ejecutar código PHP de su elección a través de vectores no especificados relacionados con una variables no inicializada. • http://archives.neohapsis.com/archives/bugtraq/2006-07/0191.html http://archives.neohapsis.com/archives/bugtraq/2006-07/0200.html http://retrogod.altervista.org/phorum5_local_incl_xpl.html http://secunia.com/advisories/21043 http://www.osvdb.org/27164 http://www.osvdb.org/27167 http://www.phorum.org/phorum5/read.php?14%2C114358 http://www.vupen.com/english/advisories/2006/2794 •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2006-3249
https://notcve.org/view.php?id=CVE-2006-3249
SQL injection vulnerability in search.php in Phorum 5.1.14 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter. NOTE: the vendor has disputed this report, stating "If a non positive integer or non-integer is used for the page parameter for a search URL, the search query will use a negative number for the LIMIT clause. This causes the query to break, showing no results. It IS NOT however a sql injection error." While the original report is from a researcher with mixed accuracy, as of 20060703, CVE does not have any additional information regarding this issue ** DISCUTIDA ** Vulnerabilidad de inyección SQL en search.php en Phorum v5.1.14 y anteriores permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro page. • http://pridels0.blogspot.com/2006/06/phorum-sql-injection-vuln.html http://www.osvdb.org/27165 http://www.phorum.org/cgi-bin/trac.cgi/ticket/382#preview http://www.phorum.org/phorum5/read.php?14%2C114358 https://exchange.xforce.ibmcloud.com/vulnerabilities/27369 •