CVE-2004-1518
Description
SQL injection in Phorum 5.0.12 and earlier allows authenticated remote users to execute arbitrary SQL via forum_id parameter.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
SQL injection in Phorum 5.0.12 and earlier allows authenticated remote users to execute arbitrary SQL via forum_id parameter.
Vulnerability
A SQL injection vulnerability exists in follow.php of Phorum 5.0.12 and earlier versions (all 5.0.x up to 5.0.12) [1]. The forum_id parameter is not properly sanitized before being used in a SQL query, allowing an authenticated attacker to inject arbitrary SQL commands [1]. The user must be logged in to exploit the vulnerability [1].
Exploitation
An attacker needs valid authentication credentials for the Phorum system [1]. The attacker sends a crafted HTTP request to follow.php with a malicious forum_id parameter containing SQL injection payload. The injected SQL is executed against the database [1].
Impact
Successful exploitation allows the authenticated attacker to execute arbitrary SQL commands on the underlying database [1]. This can lead to unauthorized disclosure, modification, or deletion of data, including potentially reading password hashes or other sensitive information from the database.
Mitigation
Phorum version 5.0.13 was released to fix the vulnerability [1]. Users should upgrade to 5.0.13 or later. No workaround is mentioned in the available reference. The vulnerability is not listed on the CISA KEV.
AI Insight generated on May 24, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
Root cause
"Missing input sanitization in follow.php allows an attacker-controlled value to reach an unquoted SQL query in phorum_db_get_message(), enabling SQL injection."
Attack vector
An attacker must be a logged-in user of Phorum. The bug is triggered by sending a crafted GET or POST request to `follow.php` with a malicious `thread` parameter (or by poisoning `$thread` via `$_GET`/`$_COOKIE` when neither `$PHORUM["args"][1]` nor `$_POST["thread"]` is set). The unsanitized value flows into `phorum_db_get_message()`, where it is interpolated directly into a SQL query without quotes, allowing SQL injection [ref_id=1]. On MySQL 4.x with UNION support, an attacker can retrieve arbitrary data, such as admin usernames and password hashes, by appending a UNION SELECT clause [ref_id=1].
Affected code
The vulnerable code is in `follow.php` (line 37) and `include/db/mysql.php` (line 642). In `follow.php`, the `$thread` variable is taken from `$_POST["thread"]` without sanitization, and the `if/elseif` construction lacks a final `else`, allowing `$thread` to be poisoned via `$_GET` or `$_COOKIE` arrays. In `mysql.php`, the function `phorum_db_get_message($message_id)` builds a SQL query with `message_id=$message_id` without quotes, enabling injection [ref_id=1].
What the fix does
The advisory states that the vendor released Phorum version 5.0.13, which includes a fix for this SQL injection bug [ref_id=1]. No patch diff is provided in the bundle, but the fix would involve properly sanitizing or quoting the `$message_id` parameter in the SQL query in `mysql.php` and ensuring that user-supplied input in `follow.php` is validated before being passed to database functions.
Preconditions
- authAttacker must be a logged-in user of Phorum
- networkAttacker must be able to send HTTP requests to follow.php
- configThe MySQL server must support UNION queries for data extraction (MySQL 4.x+)
Reproduction
The advisory provides a proof-of-concept URL that extracts admin credentials: `http://localhost/phorum5012/follow.php?forum_id=1&,f00=bar,1=-99%20UNION%20ALL%20SELECT%201%2c1%2c1%2c1%2c1%2cCONCAT(username%2c%27|%27%2cpassword)%2c1%2c1%2c1%2c1%2c1%2c1%2c1%2c1%2c1%2c1%2c1%2c1%2c1%2c1%20FROM%20phorum_users%20WHERE%20admin=1` [ref_id=1]. Additionally, sending `follow.php?forum_id=1&thread=waraxe` triggers an error revealing the injection point [ref_id=1].
Generated on May 26, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
5- secunia.com/advisories/13174nvdPatchVendor Advisory
- lists.grok.org.uk/pipermail/full-disclosure/2004-November/028609.htmlnvdExploitPatchVendor Advisory
- www.securityfocus.com/bid/11660nvdExploitPatch
- marc.infonvd
- exchange.xforce.ibmcloud.com/vulnerabilities/18045nvd
News mentions
0No linked articles in our index yet.