PT-2009-5812 · Cmsphp · Cmsphp

Published 2009-10-01 · Updated 2024-02-08 · CVE-2009-3520

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CMSphp version 0.21

Description A cross-site request forgery (CSRF) issue exists in the Your account module, allowing remote attackers to hijack administrator authentication for requests that change an administrator's password. This is achieved via the pseudo, pwd, and uid parameters in an "admin info user verif" action.

Recommendations For CMSphp version 0.21, as a temporary workaround, consider restricting access to the Your account module until a patch is available. Avoid using the pseudo, pwd, and uid parameters in the affected admin info user verif action to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2009-3520

Affected Products

Cmsphp

References · 3

• 🔥 http://packetstormsecurity.org/0909-exploits/cmsphp-xsrf.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-3520 · Security Note
• http://secunia.com/advisories/36075 · Vendor Advisory