CVE-2007-2339
HIGH 7.5EPSS 1.9%
Multiple SQL injection vulnerabilities in Phorum before 5.1.22 allow remote attackers to execute arbitrary SQL commands via (1) a modified recipients parameter name in (a) pm.php; (2) the curr parameter to the (b) badwords (aka censorlist) or (c) banlist module in admin.php; or (3) the "Edit groups / Add group" field in the (d) groups module in admin.php.
- CVSS v2.0
- 7.5 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P - EPSS
- 1.87% chance of exploitation in the next 30 days, 78th percentile
- Published
- 2007-04-27
- Updated
- 2024-08-07
Proof-of-concept exploits (1)
ExploitDB entries (3)
- https://www.exploit-db.com/exploits/29894
- https://www.exploit-db.com/exploits/29893
- https://www.exploit-db.com/exploits/29892