PT-2007-6593 · Simple Php Blog · Simple Php Blog

Publicado 2007-10-18 · Atualizado 2018-10-15 · CVE-2007-5572

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Simple PHP Blog version 0.4.9

Description The issue concerns multiple cross-site request forgery (CSRF) vulnerabilities. These vulnerabilities allow remote attackers to perform actions as administrators. Specifically, the vulnerabilities can be exploited via the block id parameter to "add block.php" or the link id parameter to "add link.php".

Recommendations For Simple PHP Blog version 0.4.9, consider implementing proper CSRF protection mechanisms, such as token-based validation, to prevent unauthorized actions. As a temporary workaround, restrict access to the "add block.php" and "add link.php" scripts to minimize the risk of exploitation. Avoid using the block id and link id parameters in these scripts until the issue is resolved.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2007-5572

Produtos afetados

Simple Php Blog

Referências · 6

• https://exchange.xforce.ibmcloud.com/vulnerabilities/37239 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5572 · Nota de Segurança
• http://hackish.altervista.org/forum/viewtopic.php?t=221 · Nota
• http://secunia.com/advisories/27264 · Nota
• http://securityfocus.com/archive/1/482422/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/37238 · Nota