PT-2007-6782 · Sblog · Sblog

Published 2007-11-05 · Updated 2018-10-15 · CVE-2007-5818

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions sBlog version 0.7.3 Beta

Description A cross-site request forgery issue allows remote attackers to modify arbitrary blocks with administrator privileges.

Recommendations For sBlog version 0.7.3 Beta, consider implementing proper CSRF token validation to prevent unauthorized requests. As a temporary workaround, restrict access to the blocks edit do.php file to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2007-5818

Affected Products

Sblog

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2007-5818 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/38216 · Note
• http://securityfocus.com/archive/1/483108/100/0/threaded · Note
• http://0x90.com.ar/Advisory/20071031.txt · Note
• http://secunia.com/advisories/27485 · Note
• http://securityreason.com/securityalert/3341 · Note