https://www.exploit-db.com/exploits/20588
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200012-205

Phorum是Phorum团队开发的一套基于PHP和MySQL的开源论坛应用程序。Phorum的auth.php3是其它文件的访问控制模块，auth.php3存在一个通用口令，远程攻击者只需在URL里加上PHP_AUTH_USER=boogieman就可以使用”boogieman”通过auth.php3的验证访问受保护的文件。远程攻击者可以利用这个漏洞获得对Phorum的控制，并且可以结合Phorum的其它漏洞访问系统的本地文件。

source: http://www.securityfocus.com/bid/2274/info

Phorum is a freely available, open source, popular WWW Board written by Brian Moon. It is designed to enhance the services offered on a web page, allow users to interact with one another through bulletin board chat and discussion.

A problem with the package allows users access to any resources within the bulletin board system. Any file that is access controlled by the auth.php3 script may be accessed, due to a backdoor password written into the script auth.php3. The password "boogieman" will permit users to access files controlled by auth.php3 by simply appending the variable PHP_AUTH_USER=boogieman to the URL. This makes it possible for users with malicious intentions to access any file under the access control of auth.php3, and potentially gain elevated privileges, including access to the local system. 

This vulnerability can be exploited by appending the PHP_USER_AUTH variable to the URL with the password "boogieman" as the value.

http://some.host.com/admin.php3

This file would not be accessible by the unauthenticated user. However,

http://some.host.com/admin.php3?PHP_AUTH_USER=boogieman

will permit access to this file.

来源:www.digitalsec.net
链接:http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm
来源:BUGTRAQ
名称:20000106Phorum3.0.7exploitsandIDSsignatures
链接:http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html
来源:BID
名称:2274
链接:http://www.securityfocus.com/bid/2274