CVE-2003-1487

Phorum 3.4-3.4.2 - Remote Command Injection via UserAdmin, Edit Profile, or Stats Program

Title source: llm
STIX 2.1

Description

Multiple "command injection" vulnerabilities in Phorum 3.4 through 3.4.2 allow remote attackers to execute arbitrary commands and modify the Phorum configuration files via the (1) UserAdmin program, (2) Edit user profile, or (3) stats program.

References (6)

Core 6
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/12500
Patch vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/7579
Patch vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/7578
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/3288
Patch vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/7574
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/321310

Scores

EPSS 0.0803
EPSS Percentile 94.1%

Details

CWE
CWE-20
Status published
Products (3)
phorum/phorum 3.4
phorum/phorum 3.4.1
phorum/phorum 3.4.2
Published Dec 31, 2003
Tracked Since Feb 18, 2026