PT-2019-12720 · My Little Forum · My Little Forum

Published 2019-05-21 · Updated 2019-05-21 · CVE-2019-12253

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions my little forum versions prior to 2.4.20

Description The issue allows for CSRF, enabling the deletion of posts. This can be demonstrated through the API endpoint "mode=posting&delete posting", where an attacker can manipulate the mode and delete posting parameters to delete posts without the user's consent.

Recommendations For versions prior to 2.4.20, update to version 2.4.20 or later to resolve the issue.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2019-12253

Affected Products

My Little Forum

References · 4

• 🔥 https://github.com/ilosuna/mylittleforum/issues/468 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-12253 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12253 · Vendor Advisory
• https://github.com/ilosuna/mylittleforum/releases/tag/2.4.20 · Note