PT-2007-6593 · Simple Php Blog · Simple Php Blog

Published 2007-10-18 · Updated 2018-10-15 · CVE-2007-5572

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Simple PHP Blog version 0.4.9

Description The issue concerns multiple cross-site request forgery (CSRF) vulnerabilities. These vulnerabilities allow remote attackers to perform actions as administrators. Specifically, the vulnerabilities can be exploited via the block id parameter to "add block.php" or the link id parameter to "add link.php".

Recommendations For Simple PHP Blog version 0.4.9, consider implementing proper CSRF protection mechanisms, such as token-based validation, to prevent unauthorized actions. As a temporary workaround, restrict access to the "add block.php" and "add link.php" scripts to minimize the risk of exploitation. Avoid using the block id and link id parameters in these scripts until the issue is resolved.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2007-5572

Affected Products

Simple Php Blog

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2007-5572 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/37239 · Note
• http://hackish.altervista.org/forum/viewtopic.php?t=221 · Note
• http://secunia.com/advisories/27264 · Note
• http://securityfocus.com/archive/1/482422/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/37238 · Note