Vulnerability CVE-2007-5918
Published: 2007-11-09   Modified: 2012-02-12

Description:
Cross-site request forgery (CSRF) vulnerability in edit.php in the MS TopSites add-on for PHP-Nuke does not verify that the uname parameter matches the current account, which allows remote authenticated users to change arbitrary accounts or change the SiteTitleName field as an arbitrary user via a modified uname value in an edit action to modules.php.

Type:

CWE-352

 (Cross-Site Request Forgery (CSRF))

CVSS2 => (AV:N/AC:M/Au:S/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6/10
6.4/10
6.8/10
Exploit range
Attack complexity
Authentication
Remote
Medium
Single time
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Ms topsites -> Ms topsites 

 References:
http://0x90.com.ar/Advisory/20071106.txt
http://www.securityfocus.com/archive/1/483353/100/0/threaded
http://www.securityfocus.com/bid/26358
Copyright 2024, cxsecurity.com

 

Back to Top