SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Forum/Board/Portal)  >   Phorum Vendors:   Phorum.org
Phorum Bulletin Board Software Discloses the E-mail Addresses of the Ten Most Active Phorum Users to Remote Users
SecurityTracker Alert ID:  1003720
SecurityTracker URL:  http://securitytracker.com/id/1003720
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Mar 2 2002
Impact:   Disclosure of system information
Exploit Included:  Yes  
Version(s): 3.3.2
Description:   An information disclosure vulnerability was reported in Phorum. A remote user can view the e-mail addresses of the ten most active users.

A remote user can reportedly use the 'admin/stats.php' script to view the ten most active users of the Phorum site. This script apparently does not limit access to only administrators.

A demonstration exploit URL is provided:

http://[targethost]/phorum/admin/stats.php

Impact:   A remote user can view the e-mail addresses of the ten most active users.
Solution:   No vendor solution was available at the time of this entry.

The author of the report has provided the following workarounds:

- Delete the script
- Rename the admin directory
- Password-protect the admin directory

Vendor URL:  www.phorum.org/ (Links to External Site)
Cause:   Access control error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)
Underlying OS Comments:  PHP-based

Message History:   None.


 Source Message Contents

Subject:  Phorum Discussion Board Security Bug (Email Disclosure)


Concerning latest Phorum version (3.3.2)

A bug in the PHP based forum script Phorum makes it possible to obtain
the email addresses of the 10 most active users. In the 'admin/'
directory of the forum there is a script called 'stats.php' that allows
administrators (and anyone else, since there is no password check on
this PHP script) to view the 10 most active users of the phorum

Exploit:
Point the browser to:
http://www.example.com/phorum/admin/stats.php
Select the range of statistics analysis and it will show some numbers
plus the ten most active users including their email addresses.

Workarounds:
- Delete the script
- Rename the admin directory
- Password-protect the admin directory

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC