CVE-2007-1520

Опубликовано: 20 мар. 2007

Источник: nvd

CVSS2: 6.8

EPSS Низкий

Описание

The cross-site request forgery (CSRF) protection in PHP-Nuke 8.0 and earlier does not ensure the SERVER superglobal is an array before validating the HTTP_REFERER, which allows remote attackers to conduct CSRF attacks.

Ссылки

http://osvdb.org/34501
http://phpfi.com/214668
Exploit
URL Repurposed
http://secunia.com/advisories/24629
Vendor Advisory
http://www.securityfocus.com/archive/1/462308/100/100/threaded
http://www.securityfocus.com/archive/1/462575/100/0/threaded
http://www.securityfocus.com/archive/1/462727/100/0/threaded
http://www.ush.it/2007/03/09/php-nuke-wild-post-xss/
Exploit
http://www.wisec.it/ush/phpnukexss.html
Exploit
http://osvdb.org/34501
http://phpfi.com/214668
Exploit
URL Repurposed
http://secunia.com/advisories/24629
Vendor Advisory
http://www.securityfocus.com/archive/1/462308/100/100/threaded
http://www.securityfocus.com/archive/1/462575/100/0/threaded
http://www.securityfocus.com/archive/1/462727/100/0/threaded
http://www.ush.it/2007/03/09/php-nuke-wild-post-xss/
Exploit
http://www.wisec.it/ush/phpnukexss.html
Exploit

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:phpnuke:php-nuke:*:*:*:*:*:*:*:*

Версия до 8.0 (включая)

cpe:2.3:a:phpnuke:php-nuke:5.6:*:*:*:*:*:*:*

cpe:2.3:a:phpnuke:php-nuke:6.5:*:*:*:*:*:*:*

cpe:2.3:a:phpnuke:php-nuke:7.0:*:*:*:*:*:*:*

cpe:2.3:a:phpnuke:php-nuke:7.1:*:*:*:*:*:*:*

cpe:2.3:a:phpnuke:php-nuke:7.2:*:*:*:*:*:*:*

cpe:2.3:a:phpnuke:php-nuke:7.3:*:*:*:*:*:*:*

cpe:2.3:a:phpnuke:php-nuke:7.4:*:*:*:*:*:*:*

cpe:2.3:a:phpnuke:php-nuke:7.5:*:*:*:*:*:*:*

cpe:2.3:a:phpnuke:php-nuke:7.6:*:*:*:*:*:*:*

cpe:2.3:a:phpnuke:php-nuke:7.7:*:*:*:*:*:*:*

cpe:2.3:a:phpnuke:php-nuke:7.8:*:*:*:*:*:*:*

cpe:2.3:a:phpnuke:php-nuke:7.9:*:*:*:*:*:*:*

EPSS

Процентиль: 70%

0.00651

Низкий

6.8 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

GHSA-cf65-qrmp-4447

github

почти 4 года назад