PT-2012-6172 · Dalbum · Dalbum

Ahmed Elhady Mohamed · Published 2012-11-17 · Updated 2013-01-15 · CVE-2012-5891

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DAlbum versions 1.44 build 174 and earlier

Description The issue affects the photo/pass.php file, allowing remote attackers to exploit multiple cross-site request forgery (CSRF) vulnerabilities. These vulnerabilities enable attackers to hijack the authentication of administrators for specific requests, including adding a user via an add action, changing user passwords via a change action, or deleting a user via a delete action.

Recommendations For DAlbum versions 1.44 build 174 and earlier, as a temporary workaround, consider disabling the add, change, and delete actions in the photo/pass.php file until a patch is available. Restrict access to the photo/pass.php file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2012-5891

Affected Products

Dalbum

References · 5

• 🔥 https://exploit-db.com/exploits/18685 · Exploit
• 🔥 http://packetstormsecurity.org/files/111402/Dalbum-144-Build-174-Cross-Site-Request-Forgery.html · Exploit
• 🔥 http://exploit-db.com/exploits/18685 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-5891 · Security Note
• http://osvdb.org/80745 · Note