PT-2008-5268 · Opendb · Opendb

Published 2008-09-05 · Updated 2008-09-05 · CVE-2008-3938

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenDb version 1.0.6

Description A cross-site request forgery (CSRF) issue exists, allowing remote attackers to change arbitrary passwords. This is achieved via an update password action in the user admin.php file.

Recommendations For OpenDb version 1.0.6, consider implementing CSRF protection mechanisms, such as tokens, to prevent unauthorized password changes. As a temporary workaround, restrict access to the user admin.php file until a patch is available.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2008-3938

Affected Products

Opendb

References · 3

• 🔥 http://packetstorm.linuxsecurity.com/0808-exploits/omcd-xssxsrf.txt · Exploit
• http://secunia.com/advisories/31719 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-3938 · Security Note