PT-2008-5268 · Opendb · Opendb

Publicado 2008-09-05 · Atualizado 2008-09-05 · CVE-2008-3938

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenDb version 1.0.6

Description A cross-site request forgery (CSRF) issue exists, allowing remote attackers to change arbitrary passwords. This is achieved via an update password action in the user admin.php file.

Recommendations For OpenDb version 1.0.6, consider implementing CSRF protection mechanisms, such as tokens, to prevent unauthorized password changes. As a temporary workaround, restrict access to the user admin.php file until a patch is available.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2008-3938

Produtos afetados

Opendb

Referências · 3

• 🔥 http://packetstorm.linuxsecurity.com/0808-exploits/omcd-xssxsrf.txt · Exploit
• http://secunia.com/advisories/31719 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-3938 · Nota de Segurança