Zorum <= 3.5 Multiple Remote Vulnerabilities

high Nessus Plugin ID 17312

Synopsis

The remote web server contains a PHP application that is affected by numerous flaws.

Description

The remote host is running Zorum, an open source electronic forum written in PHP.

The version of Zorum installed on the remote host is prone to numerous flaws, including remote code execution, privilege escalation, and SQL injection.

Solution

Remove the software as it is no longer maintained.

See Also

http://retrogod.altervista.org/zorum.html

https://securitytracker.com/id?1013365

http://www.nessus.org/u?2771c30c

http://www.nessus.org/u?b262f66c

Plugin Details

Severity: High

ID: 17312

File Name: zorum_multiple_vulns.nasl

Version: 1.37

Type: remote

Family: CGI abuses

Published: 3/11/2005

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.3

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/a:phpoutsourcing:zorum

Required KB Items: www/PHP

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Ease: No exploit is required

Vulnerability Publication Date: 8/18/2005

Reference Information

CVE: CVE-2005-0675, CVE-2005-0676, CVE-2005-0677, CVE-2005-2651, CVE-2005-4619, CVE-2006-3332

BID: 12777, 14601, 16131, 18681