PT-2007-3019 · Phprojekt · Phprojekt

Published 2007-03-23 · Updated 2018-10-16 · CVE-2007-1638

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: PHProjekt version 5.2.0

Description: The issue concerns multiple cross-site request forgery (CSRF) vulnerabilities in the check csrftoken function. These vulnerabilities allow remote attackers to perform unauthorized actions as an arbitrary user via various modules, including Projects, Contacts, Helpdesk, Notes, Search, Mail, or Filemanager, as well as the summary page and other unspecified files, when magic quotes gpc is disabled.

Recommendations: For PHProjekt version 5.2.0, consider disabling the check csrftoken function temporarily until a patch is available, or apply configuration changes to enable magic quotes gpc to mitigate the risk of exploitation.

Fix

Related Identifiers

CVE-2007-1638

Affected Products

Phprojekt

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2007-1638 · Security Note
• http://security.gentoo.org/glsa/glsa-200706-07.xml · Vendor Advisory
• http://secunia.com/advisories/24509 · Vendor Advisory
• http://phprojekt.com/index.php?name=News&file=article&sid=276 · Note
• http://osvdb.org/35162 · Note
• http://secunia.com/advisories/25748 · Note
• http://securityfocus.com/archive/1/462786/100/100/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32989 · Note
• http://nruns.de/security_advisory_phprojekt_csrf.php · Note
• http://securityreason.com/securityalert/2477 · Note