CVE-2000-1233

HighCVSS 7.5/10Last modified Sep 23, 2026

Description

SQL injection vulnerability in read.php3 and other scripts in Phorum 3.0.7 allows remote attackers to execute arbitrary SQL queries via the sSQL parameter.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.htmlExploit, Patch, Vendor Advisory
http://hispahack.ccc.de/mi020.html
http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm
http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.htmlExploit, Patch, Vendor Advisory
http://hispahack.ccc.de/mi020.html
http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm

Timeline

Published: Dec 31, 2000
Last modified: Sep 23, 2026
NVD status: Modified

Related CVEs from 2000

CVE-2000-12345.0violation.php3 in Phorum 3.0.7 allows remote attackers to send e-mails to arbitrary addresses and possibly use Phorum as a "spam proxy" by s CVE-2000-12355.0The default configurations of (1) the port listener and (2) modplsql in Oracle Internet Application Server (IAS) 3.0.7 and earlier allow rem CVE-2000-12367.5SQL injection vulnerability in mod_sql in Oracle Internet Application Server (IAS) 3.0.7 and earlier allows remote attackers to execute arbi CVE-2000-12375.0The POP3 server in FTGate returns an -ERR code after receiving an invalid USER request, which makes it easier for remote attackers to determ CVE-2000-12387.5BEA Systems WebLogic Express and WebLogic Server 5.1 SP1-SP6 allows remote attackers to bypass access controls for restricted JSP or servlet CVE-2000-12399.0The HTTP interface of Tivoli Lightweight Client Framework (LCF) in IBM Tivoli Management Framework 3.7.1 sets http_disable to zero at instal CVE-2000-12405.0Unspecified vulnerability in siteman.php3 in AnyPortal(php) before 22 APR 00 allows remote attackers to obtain sensitive information via unk CVE-2000-124110.0Unspecified vulnerability in Haakon Nilsen simple, integrated publishing system (SIPS) before 0.2.4 has an unknown impact and attack vectors CVE-2000-12429.0The HTTP service in American Power Conversion (APC) PowerChute uses a default username and password, which allows remote attackers to gain s CVE-2000-12435.0Privacy leak in Dansie Shopping Cart 3.04, and probably earlier versions, sends sensitive information such as user credentials to an e-mail CVE-2000-12447.5Computer Associates InoculateIT Agent for Exchange Server does not recognize an e-mail virus attachment if the SMTP header is missing the "F CVE-2000-12457.5Multiple unspecified vulnerabilities in NWFTPD.nlm before 5.01o in the FTP server in Novell NetWare 5.1 SP3 allow remote attackers to bypass