Phorum Stats Program Arbitrary Command Execution Vulnerability

Bugtraq ID:	7579
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 13 2003 12:00AM
Updated:	May 13 2003 12:00AM
Credit:	Discovery of this vulnerability has been credited to Procheckup Ltd.
Vulnerable:	Phorum Phorum 3.4.2 Phorum Phorum 3.4.1 Phorum Phorum 3.4
Not Vulnerable:	Phorum Phorum 3.4.3

Phorum Stats Program Arbitrary Command Execution Vulnerability

Phorum has been reported prone to remote arbitrary command execution vulnerability.

The issue presents itself due to a lack of sufficient sanitization performed on user-supplied data submitted to the Phorum Stats program.

Phorum Stats Program Arbitrary Command Execution Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Phorum Stats Program Arbitrary Command Execution Vulnerability

Solution:
The vendor has addressed this issue in the current version of the software.


Phorum Phorum 3.4

• Phorum phorum-3.4.3.tar.gz
  http://phorum.org/downloads/phorum-3.4.3.tar.gz

Phorum Phorum 3.4.1

• Phorum phorum-3.4.3.tar.gz
  http://phorum.org/downloads/phorum-3.4.3.tar.gz

Phorum Phorum 3.4.2

• Phorum phorum-3.4.3.tar.gz
  http://phorum.org/downloads/phorum-3.4.3.tar.gz