violation.php3 in Phorum 3.0.7 allows remote attackers to send e-mails to arbitrary addresses and possibly use Phorum as a "spam proxy" by setting the Mod and ForumName parameters.
No PoCs from references.
- https://github.com/SarahX/DWF-Documentation
- https://github.com/kurtseifried/gsd-data-enrichment