CVE:CVE-2007-2339
CNNVD:CNNVD-200704-569
Phorum是一款基于PHP的WEB论坛程序，可在Linux和Unix操作系统下使用，也可在Microsoft Windows操作系统下使用。 
Phorum的pm.php文件中recipients参数可能导致SQL注入漏洞。在include/db/mysq.php文件的1881行：
------------------[source code]----------------------
function phorum_db_user_get($user_id, $detailed)
{
    $PHORUM = $GLOBALS["PHORUM"];
    $conn = phorum_db_mysql_connect();
    if(is_array($user_id)){
        $user_ids=implode(",", $user_id);
    } else {
        $user_ids=(int)$user_id;
    }
    $users = array();
    $sql = "select * from {$PHORUM['user_table']} where user_id in ($user_ids)";
    $res = mysql_query($sql, $conn);
    if ($err = mysql_error()) phorum_db_mysql_error("$err: $sql");
solution:Upgrade phorum phorum to a higher version than 5.1.20,and avoid the version (,5.1.20]