CVE-2000-1228

MediumCVSS 5.0/10Last modified Sep 23, 2026

Description

Phorum 3.0.7 allows remote attackers to change the administrator password without authentication via an HTTP request for admin.php3 that sets step, option, confirm and newPssword variables.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.htmlExploit, Patch, Vendor Advisory
http://hispahack.ccc.de/mi020.html
http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm
http://www.securityfocus.com/bid/2271Exploit, Patch
http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.htmlExploit, Patch, Vendor Advisory
http://hispahack.ccc.de/mi020.html
http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm
http://www.securityfocus.com/bid/2271Exploit, Patch

Timeline

Published: Dec 31, 2000
Last modified: Sep 23, 2026
NVD status: Modified

Related CVEs from 2000

CVE-2000-12295.0Directory traversal vulnerability in Phorum 3.0.7 allows remote Phorum administrators to read arbitrary files via ".." (dot dot) sequences i CVE-2000-12305.0Backdoor in auth.php3 in Phorum 3.0.7 allows remote attackers to access restricted web pages via an HTTP request with the PHP_AUTH_USER para CVE-2000-12315.0code.php3 in Phorum 3.0.7 allows remote attackers to read arbitrary files in the phorum directory via the query string.CVE-2000-12325.0upgrade.php3 in Phorum 3.0.7 could allow remote attackers to modify certain Phorum database tables via an unknown method.CVE-2000-12337.5SQL injection vulnerability in read.php3 and other scripts in Phorum 3.0.7 allows remote attackers to execute arbitrary SQL queries via the CVE-2000-12345.0violation.php3 in Phorum 3.0.7 allows remote attackers to send e-mails to arbitrary addresses and possibly use Phorum as a "spam proxy" by s CVE-2000-12355.0The default configurations of (1) the port listener and (2) modplsql in Oracle Internet Application Server (IAS) 3.0.7 and earlier allow rem CVE-2000-12367.5SQL injection vulnerability in mod_sql in Oracle Internet Application Server (IAS) 3.0.7 and earlier allows remote attackers to execute arbi CVE-2000-12375.0The POP3 server in FTGate returns an -ERR code after receiving an invalid USER request, which makes it easier for remote attackers to determ CVE-2000-12387.5BEA Systems WebLogic Express and WebLogic Server 5.1 SP1-SP6 allows remote attackers to bypass access controls for restricted JSP or servlet CVE-2000-12399.0The HTTP interface of Tivoli Lightweight Client Framework (LCF) in IBM Tivoli Management Framework 3.7.1 sets http_disable to zero at instal CVE-2000-12405.0Unspecified vulnerability in siteman.php3 in AnyPortal(php) before 22 APR 00 allows remote attackers to obtain sensitive information via unk