Phorum Login.PHP Connection Proxying Vulnerability

Bugtraq ID:	7583
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	May 13 2003 12:00AM
Updated:	May 13 2003 12:00AM
Credit:	Discovery of this vulnerability has been credited to Procheckup Ltd.
Vulnerable:	Phorum Phorum 3.4.2 Phorum Phorum 3.4.1 Phorum Phorum 3.4
Not Vulnerable:	Phorum Phorum 3.4.3

Phorum Login.PHP Connection Proxying Vulnerability

The Phorum 'login.php' script has been reported prone to a connecting proxying vulnerability.

It has been reported that an attacker may harness the vulnerable 'login.php' script to anonymously launch attacks on other hosts in the context of the website hosting the vulnerable Phorum.

Phorum Login.PHP Connection Proxying Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Phorum Login.PHP Connection Proxying Vulnerability

Solution:
The vendor has addressed this issue in the current version of the software.


Phorum Phorum 3.4

• Phorum phorum-3.4.3.tar.gz
  http://phorum.org/downloads/phorum-3.4.3.tar.gz

Phorum Phorum 3.4.1

• Phorum phorum-3.4.3.tar.gz
  http://phorum.org/downloads/phorum-3.4.3.tar.gz

Phorum Phorum 3.4.2

• Phorum phorum-3.4.3.tar.gz
  http://phorum.org/downloads/phorum-3.4.3.tar.gz

Phorum Login.PHP Connection Proxying Vulnerability

References:

• Phorum Homepage (Phorum)
  
• Phorum Vulnerabilities ()