Phorum PHP Configuration Disclosure Vulnerability

Bugtraq ID:	1985
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Nov 23 2000 12:00AM
Updated:	Nov 23 2000 12:00AM
Credit:	Discovered by Joao Gouveia <[email protected]>.
Vulnerable:	Phorum Phorum 3.2.7 Phorum Phorum 3.2.6 Phorum Phorum 3.2.5 Phorum Phorum 3.2.4 Phorum Phorum 3.2.3 b Phorum Phorum 3.2.3 a Phorum Phorum 3.2.3 Phorum Phorum 3.2.2 Phorum Phorum 3.2 Phorum Phorum 3.1.2 Phorum Phorum 3.1.1 rc2 Phorum Phorum 3.1.1 pre Phorum Phorum 3.1.1 a Phorum Phorum 3.1.1 Phorum Phorum 3.1
Not Vulnerable:	Phorum Phorum 3.2.8

Phorum PHP Configuration Disclosure Vulnerability

Phorum is a PHP based web forums package. Due to an error in the implementation of forum selection in administrative scripts, any user can view the any PHP script on the target host. This is due to user-supplied input being referenced as a filename in two locations in the file common.php. For example:

if($num || $f){
if($f) $num=$f;
if(file_exists("$admindir/forums/$num.php")){
include "$admindir/forums/$num.php";
}

where $f is read from user input via a form, and is meant to be the name of a selected forum. However, any value can be submitted as $f and the corresponding PHP file will be displayed to the browser. This could lead to disclosure of sensitive information, including the MySql server, database name, userid and password, which are kept in master.php.

Phorum PHP Configuration Disclosure Vulnerability

http://target/cgi-bin/forums/list.php?f=DESIRED_PHP_FILE_WITHOUT_EXTENSION

Phorum PHP Configuration Disclosure Vulnerability

Solution:
Phorum version 3.2.8 is now available and has these issues resolved. To download the latest version, see the Phorum downloads page at;
http://www.phorum.org/download.php

For users who do not wish to upgrade, there is patch information available at:
http://www.phorum.org/

Phorum PHP Configuration Disclosure Vulnerability

References:

• Phorum Homepage (Phorum)