← Vulnerability feed

Vulnerability record · CVE-2007-2339 · published 27 April 2007

CVE-2007-2339: Phorum vulnerability

Phorum · Phorum

Multiple SQL injection vulnerabilities in Phorum before 5.1.22 allow remote attackers to execute arbitrary SQL commands via (1) a modified recipients parameter name in (a) pm.php; (2) the curr parameter to the (b) badwords (aka censorlist) or (c) banlist module in admin.php; or (3) the "Edit groups / Add group" field in the (d) groups module in admin.php.

7.5 CVSS 2.0 High EPSS 1.9% · top 21.5%
7.5CVSS 2.0 base score
1.9%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
24References, 6 tagged exploit
16 Jun 2026Last modified by NVD

Description

Multiple SQL injection vulnerabilities in Phorum before 5.1.22 allow remote attackers to execute arbitrary SQL commands via (1) a modified recipients parameter name in (a) pm.php; (2) the curr parameter to the (b) badwords (aka censorlist) or (c) banlist module in admin.php; or (3) the "Edit groups / Add group" field in the (d) groups module in admin.php.

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://osvdb.org/35062
http://osvdb.org/35063
http://osvdb.org/35064
http://secunia.com/advisories/24932 PatchVendor Advisory
http://securityreason.com/securityalert/2617
http://securitytracker.com/id?1017936 Exploit
http://www.phorum.org/story.php?76
http://www.securityfocus.com/archive/1/466286/100/0/threaded
http://www.securityfocus.com/bid/23616 ExploitPatch
http://www.vupen.com/english/advisories/2007/1479
http://www.waraxe.us/advisory-49.html ExploitVendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/34081
http://osvdb.org/35062
http://osvdb.org/35063
http://osvdb.org/35064
http://secunia.com/advisories/24932 PatchVendor Advisory
http://securityreason.com/securityalert/2617
http://securitytracker.com/id?1017936 Exploit
http://www.phorum.org/story.php?76
http://www.securityfocus.com/archive/1/466286/100/0/threaded
http://www.securityfocus.com/bid/23616 ExploitPatch
http://www.vupen.com/english/advisories/2007/1479
http://www.waraxe.us/advisory-49.html ExploitVendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/34081

Track CVE-2007-2339 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2003-1487Phorum improper input validation vulnerabilityMultiple "command injection" vulnerabilities in Phorum 3.4 through 3.4.2 allow remote attackers to execute arbitrary commands and modify the Phorum c…EPSS 8.0%7.5CVE-2007-2338Phorum vulnerabilityCross-site request forgery (CSRF) vulnerability in include/admin/banlist.php in Phorum before 5.1.22 allows remote attackers to perform unauthorized …EPSS 8.7%7.5CVE-2006-6550Phorum vulnerabilityPHP remote file inclusion vulnerability in common.php in Phorum 3.2.11 and earlier allows remote attackers to execute arbitrary PHP code via a URL in…EPSS 2.2%7.5CVE-2006-3249Phorum vulnerabilitySQL injection vulnerability in search.php in Phorum 5.1.14 and earlier allows remote attackers to execute arbitrary SQL commands via the page paramet…EPSS 1.2%7.5CVE-2006-3053Phorum vulnerabilityPHP remote file inclusion vulnerability in common.php in PHORUM 5.1.13 and earlier allows remote attackers to execute arbitrary PHP code via a URL in…EPSS 2.9%7.5CVE-2004-2110Phorum vulnerabilitySQL injection vulnerability in register.php in Phorum before 3.4.6 allows remote attackers to execute arbitrary SQL commands via the hide_email param…EPSS 1.1%7.5CVE-2004-2240Phorum vulnerabilityMultiple SQL injection vulnerabilities in Phorum 5.0.11 and earlier allow remote attackers to modify SQL statements via (1) the query string in read.…EPSS 1.6%7.5CVE-2004-2243Phorum vulnerabilityPhorum allows remote attackers to hijack sessions of other users by stealing and replaying the session hash in the phorum_uriauth parameter, as demon…EPSS 1.5%

Source: NIST National Vulnerability Database (record CVE-2007-2339), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.