CVE-2004-2240

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Multiple SQL injection vulnerabilities in Phorum 5.0.11 and earlier allow remote attackers to modify SQL statements via (1) the query string in read.php or (2) unknown vectors in file.php.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://phorum.org/cvs-changelog-5.txt
http://secunia.com/advisories/12980Vendor Advisory
http://securitytracker.com/id?1011921Exploit
http://www.maxpatrol.com/advdetails.asp?id=15Exploit, Vendor Advisory
http://www.maxpatrol.com/mp_advisory.asp
http://www.osvdb.org/11129Exploit, Patch
http://www.securityfocus.com/bid/11538
https://exchange.xforce.ibmcloud.com/vulnerabilities/17847
http://phorum.org/cvs-changelog-5.txt
http://secunia.com/advisories/12980Vendor Advisory
http://securitytracker.com/id?1011921Exploit
http://www.maxpatrol.com/advdetails.asp?id=15Exploit, Vendor Advisory
http://www.maxpatrol.com/mp_advisory.asp
http://www.osvdb.org/11129Exploit, Patch
http://www.securityfocus.com/bid/11538
https://exchange.xforce.ibmcloud.com/vulnerabilities/17847

Timeline

Published: Dec 31, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-22414.3Cross-site scripting (XSS) vulnerability in Phorum 5.0.11 and earlier allows remote attackers to inject arbitrary HTML or web script via sea CVE-2004-22424.3Cross-site scripting (XSS) vulnerability in search.php in Phorum, possibly 5.0.7 beta and earlier, allows remote attackers to inject arbitra CVE-2004-22437.5Phorum allows remote attackers to hijack sessions of other users by stealing and replaying the session hash in the phorum_uriauth parameter,CVE-2004-22445.0The XML parser in Oracle 9i Application Server Release 2 9.0.3.0 and 9.0.3.1, 9.0.2.3 and earlier, and Release 1 1.0.2.2 and 1.0.2.2.2, and CVE-2004-22454.3Cross-site scripting (XSS) vulnerability in Goollery 0.03 allows remote attackers to inject arbitrary HTML or web script via the (1) page pa CVE-2004-22464.3Cross-site scripting (XSS) vulnerability in Goollery before 0.04b allows remote attackers to inject arbitrary HTML or web script via the con CVE-2004-224710.0Unknown vulnerability in the "admin of paypal email addresses" in AudienceConnect before 1.0.beta.21 has unknown impact and attack vectors.CVE-2004-224810.0Unknown vulnerability in RemoteEditor before 0.1.1 has unknown impact and attack vectors, related to "oversize submissions."CVE-2004-22497.5Unknown vulnerability in the "access code" in SecureEditor before 0.1.2 has unknown impact and attack vectors, possibly involving a bypass o CVE-2004-22507.5Unknown vulnerability in the "access code" in RemoteEditor before 0.1.6 has unknown impact and attack vectors, possibly involving a bypass o CVE-2004-22515.0The PPTP server in Astaro Security Linux before 4.024 provides information about its version, which makes it easier for remote attackers to CVE-2004-22525.0The firewall in Astaro Security Linux before 4.024 sends responses to SYN-FIN packets, which makes it easier for remote attackers to obtain