CVE-2004-1938

Phorum 3.4.7 - SQL Injection via Doubly Hex-Encoded Characters

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2004-1938. PoCs published by Janek Vind.

AI-analyzed exploit summary The provided text describes a remote SQL injection vulnerability in Phorum due to improper sanitization of user-supplied URI input. It outlines potential impacts such as unauthorized access to sensitive data or database corruption.

Description

SQL injection vulnerability in userlogin.php in Phorum 3.4.7 allows remote attackers to execute arbitrary SQL commands via doubly hex-encoded characters such as "%2527", which is translated to "'", as demonstrated using the phorum_uriauth parameter to list.php.

Exploits (1)

exploitdb WRITEUP VERIFIED
by Janek Vind · textwebappsphp
https://www.exploit-db.com/exploits/24016

The provided text describes a remote SQL injection vulnerability in Phorum due to improper sanitization of user-supplied URI input. It outlines potential impacts such as unauthorized access to sensitive data or database corruption.

Classification
Writeup 90%
Attack Type
Sqli
Complexity
Trivial
Reliability
Theoretical
Target: Phorum (version not specified)
No auth needed
Prerequisites: Access to the target application's URI parameters
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (5)

Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/15894
Exploit, Patch, Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/11407
Mailing List mailing-list x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=108239796512897&w=2
Exploit, Vendor Advisory x_refsource_misc
http://www.waraxe.us/index.php?modname=sa&id=19
Exploit, Patch, Vendor Advisory vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/10173

Scores

EPSS 0.0123
EPSS Percentile 65.0%

Details

Status published
Products (2)
phorum/phorum 3.4.7
phorum/phorum 3.4.8
Published Apr 19, 2004
Tracked Since Feb 18, 2026