PT-2012-6172 · Dalbum · Dalbum

Ahmed Elhady Mohamed · Publicado 2012-11-17 · Atualizado 2013-01-15 · CVE-2012-5891

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DAlbum versions 1.44 build 174 and earlier

Description The issue affects the photo/pass.php file, allowing remote attackers to exploit multiple cross-site request forgery (CSRF) vulnerabilities. These vulnerabilities enable attackers to hijack the authentication of administrators for specific requests, including adding a user via an add action, changing user passwords via a change action, or deleting a user via a delete action.

Recommendations For DAlbum versions 1.44 build 174 and earlier, as a temporary workaround, consider disabling the add, change, and delete actions in the photo/pass.php file until a patch is available. Restrict access to the photo/pass.php file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2012-5891

Produtos afetados

Dalbum

Referências · 5

• 🔥 https://exploit-db.com/exploits/18685 · Exploit
• 🔥 http://packetstormsecurity.org/files/111402/Dalbum-144-Build-174-Cross-Site-Request-Forgery.html · Exploit
• 🔥 http://exploit-db.com/exploits/18685 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-5891 · Nota de Segurança
• http://osvdb.org/80745 · Nota