PT-2006-5369 · Unknown · Address Book

Publicado 2006-12-31 · Atualizado 2017-07-20 · CVE-2006-4582

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions The Address Book version 1.04e

Description A cross-site request forgery issue allows remote attackers to perform unauthorized actions as other users. This can be achieved by manipulating the id parameter in a deleteuser action within the users.php file, potentially leading to the deletion of arbitrary users.

Recommendations For version 1.04e, consider implementing proper CSRF protection mechanisms, such as token-based validation, to prevent unauthorized actions. As a temporary workaround, restrict access to the users.php file and the deleteuser action to minimize the risk of exploitation. Avoid using the id parameter in the deleteuser action until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2006-4582

Produtos afetados

Address Book

Referências · 5

• 🔥 http://secunia.com/advisories/21694 · Exploit
• 🔥 http://secunia.com/secunia_research/2006-76/advisory · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31251 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-4582 · Nota de Segurança
• http://osvdb.org/32559 · Nota