Signature Detail
Short Name |
HTTP:PHP:PHORUM:ADMIN-PW-CHG |
|---|---|
Severity |
High |
Recommended |
No |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
Phorum admin.php3 Unverified Administrative Password Change |
Release Date |
2003/04/22 |
Update Number |
1213 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: Phorum admin.php3 Unverified Administrative Password Change
This signature detects attempts to exploit the vulnerable admin.php3 script in Phorum. Attackers can remotely send a maliciously crafted string to the script, change the administrative board password without user verification, and access restricted files on the local system.
Extended Description
Phorum is a popular, free, open source software package originally written by Brian Moon. The package is designed to add chat/bulletin board style interaction between visitors of a web site. A problem with Phorum can allow remote users access to restricted files on the local system. This is due to the handling of passwords by the program. By sending a custom crafted string to the admin.php3 script, it's possible to change the administrative password of the board without verification of the users credentials. The "default .langname name" field in the Master settings can then be changed to any file of the users liking, which upon reload, will be output as the page. This problem makes it possible for a user with malicious motives to take control of the message board, read any file on the system, and potentially gain remote access.
Affected Products
- Brian Moon Phorum 3.0.7
References
- BugTraq: 2271
- CVE: CVE-2000-1229