| Package | Affected versions | Patched versions |
|---|---|---|
| phorum | = 3.0.7= 3.1= 3.1.1= 3.1.1_pre= 3.1.1_rc2= 3.1.1a= 3.1.2= 3.2= 3.2.2= 3.2.3= 3.2.3a= 3.2.3b= 3.2.4= 3.2.5= 3.2.6= 3.2.7= 3.2.8= 3.3.1= 3.3.1a= 3.3.2= 3.3.2a= 3.3.2b3= 3.4= 3.4.1= 3.4.2= 3.4.3= 3.4.4= 3.4.5= 3.4.6= 3.4.7= 3.4.8= 3.4.8a= 4.3.7= 5.0.0_alpha= 5.0.10= 5.0.11= 5.0.12= 5.0.13= 5.0.13a= 5.0.14= 5.0.14a= 5.0.15= 5.0.15a= 5.0.16= 5.0.17= 5.0.17a= 5.0.18= 5.0.19= 5.0.1_alpha= 5.0.20= 5.0.2_alpha= 5.0.3_beta= 5.0.4_beta= 5.0.4a_beta= 5.0.5_beta= 5.0.6_beta= 5.0.7_beta= 5.0.7a_beta= 5.0.8_rc= 5.0.9= 5.1.13≤ 5.1.14 |
Directory traversal vulnerability in pm.php in Phorum 5 allows remote authenticated users to include and execute arbitrary local files via directory traversal sequences in the GLOBALS[template] parameter, as demonstrated by injecting PHP sequences into a log file, which is then included by pm.php.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free