PT-2009-2648 · Unknown · Butterfly Organizer

Stack · Published 2009-09-08 · Updated 2017-09-29 · CVE-2008-7181

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Butterfly Organizer version 2.0.0

Description The issue allows remote attackers to perform unauthorized actions. This includes deleting arbitrary categories by modifying the tablehere parameter in the "category-delete.php" endpoint with is js confirmed set to 1, or deleting arbitrary accounts via the mytable parameter in the "delete.php" endpoint.

Recommendations For Butterfly Organizer version 2.0.0, as a temporary workaround, consider restricting access to the "category-delete.php" and "delete.php" endpoints until a patch is available. Avoid using the tablehere and mytable parameters in these endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-7181

Affected Products

Butterfly Organizer

References · 4

• 🔥 https://exploit-db.com/exploits/5800 · Exploit
• 🔥 http://securityfocus.com/bid/29703 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-7181 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43067 · Note