5.0med
CVE-2000-12281 exploit
Phorum 3.0.7 allows remote attackers to change the administrator password without authentication via an HTTP request for admin.php3 that se…
Published 25 y ago · modified 45 d ago · JSON
CVSS
5.0
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.5%
percentile 85%
Public exploits
1
Exploit-DB
Summary
Phorum 3.0.7 allows remote attackers to change the administrator password without authentication via an HTTP request for admin.php3 that sets step, option, confirm and newPssword variables.
Exploit prediction (EPSS)
2.46% probability of exploitation in the next 30 days, higher than 85% of all scored CVEs.
Exploits and detections
- EDB-20586 Phorum 3.0.7 - 'admin.php3' Unverified Administrative Password Change · webapps · 2000-01-06
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
References
- securityfocus.com /bid/2271 · vdb-entry, x_refsource_BID, x_transferred
- cert.uni-stuttgart.de /archive/bugtraq/2000/01/msg00215.html · mailing-list, x_refsource_BUGTRAQ, x_transferred
- digitalsec.net /stuff/z-mirrors/hispahack/mi020.htm · x_refsource_MISC, x_transferred
- hispahack.ccc.de /mi020.html · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2000-1228
- NVD: CVE-2000-1228
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.