Description
post_message_form.asp in Web Wiz Forums 6.34 through 7.5, when quote mode is used, allows remote attackers to read or write to private forums by modifying the FID (forum ID) parameter.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Web Wiz Forum 6.34/7.0/7.5 - Unauthorized Private Forum Access EDB-23331 · webapps · Nov 3, 2003 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 8957 vdb-entry
- 2768 vdb-entry
- 10137 third-party-advisory
- 20031102 Unauthorized access in Web Wiz Forum mailing-list
- webwizforums-quotemode-message-access(13581) vdb-entry
- 20031104 Re: Unauthorized access in Web Wiz Forum mailing-list
- 1008100 vdb-entry