Phorum Arbitrary File Disclosure Vulnerability

vendor:

Phorum

by:

SecurityFocus

7.5

CVSS

HIGH

Arbitrary File Disclosure

CWE

Product Name: Phorum

Affected Version From: Phorum 3.3.1

Affected Version To: Phorum 3.3.2

Patch Exists: YES

Related CWE: N/A

CPE: a:phorum:phorum:3.3.1

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2002

Phorum Arbitrary File Disclosure Vulnerability

Phorum is a PHP based web forums package. Due to an error in the handling of user input in administrative scripts, any user can view the any file readable by the webserver on the target host. This is due to user-supplied input being referenced as a filename in two locations in the file common.php. The ForumLang variable, used to specify a language in which the forum will be displayed, is not checked for "../" character sequences. As a result, it is possible for users to supply a path consisting of "../" sequences followed by an arbitrary file on the filesystem to the script, which will open it and display its contents.

Mitigation:

Input validation should be used to ensure that user-supplied input is not used to access arbitrary files on the filesystem.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/1997/info

Phorum is a PHP based web forums package. Due to an error in the handling of user input in administrative scripts, any user can view the any file readable by the webserver on the target host. This is due to user-supplied input being referenced as a filename in two locations in the file common.php.

The ForumLang variable, used to specify a language in which the forum will be displayed, is not checked for "../" character sequences. As a result, it is possible for users to supply a path consisting of "../" sequences followed by an arbitrary file on the filesystem to the script, which will open it and display its contents.

The consequences of this vulnerability being exploited is a disclosure of system information (eg valid accounts). Under certain circumstances, this may also indirectly lead to the attacker gaining local access to the system. 


http://phorum.org/support/common.php?f=0&ForumLang=../../../../../../../etc/resolv.conf