CVE-2011-1482

Multiple cross-site request forgery (CSRF) vulnerabilities in mainfile.php in Francisco Burzi PHP-Nuke 8.0 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add user accounts or (2) grant the administrative privilege to a user account, related to a Referer check that uses a substring comparison.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.openwall.com/lists/oss-security/2011/03/23/9	Exploit
http://www.openwall.com/lists/oss-security/2011/03/30/8	Exploit
http://yehg.net/lab/pr0js/advisories/%5Bphpnuke-8.x%5D_cross_site_request_forgery
http://www.openwall.com/lists/oss-security/2011/03/23/9	Exploit
http://www.openwall.com/lists/oss-security/2011/03/30/8	Exploit
http://yehg.net/lab/pr0js/advisories/%5Bphpnuke-8.x%5D_cross_site_request_forgery

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:phpnuke:php-nuke::::::::
	cpe:2.3:a:phpnuke:php-nuke:5.0:::::::*
	cpe:2.3:a:phpnuke:php-nuke:5.0.1:::::::*
	cpe:2.3:a:phpnuke:php-nuke:5.1:::::::*
	cpe:2.3:a:phpnuke:php-nuke:5.2:::::::*
	cpe:2.3:a:phpnuke:php-nuke:5.3:::::::*
	cpe:2.3:a:phpnuke:php-nuke:5.3.1:::::::*
	cpe:2.3:a:phpnuke:php-nuke:5.4:::::::*
	cpe:2.3:a:phpnuke:php-nuke:5.5:::::::*
	cpe:2.3:a:phpnuke:php-nuke:5.6:::::::*
	cpe:2.3:a:phpnuke:php-nuke:6.0:::::::*
	cpe:2.3:a:phpnuke:php-nuke:6.5:::::::*
	cpe:2.3:a:phpnuke:php-nuke:6.6:::::::*
	cpe:2.3:a:phpnuke:php-nuke:6.7:::::::*
	cpe:2.3:a:phpnuke:php-nuke:6.8:::::::*
	cpe:2.3:a:phpnuke:php-nuke:6.9:::::::*
	cpe:2.3:a:phpnuke:php-nuke:7.0:::::::*
	cpe:2.3:a:phpnuke:php-nuke:7.1:::::::*
	cpe:2.3:a:phpnuke:php-nuke:7.2:::::::*
	cpe:2.3:a:phpnuke:php-nuke:7.3:::::::*
	cpe:2.3:a:phpnuke:php-nuke:7.4:::::::*
	cpe:2.3:a:phpnuke:php-nuke:7.5:::::::*
	cpe:2.3:a:phpnuke:php-nuke:7.6:::::::*
	cpe:2.3:a:phpnuke:php-nuke:7.7:::::::*
	cpe:2.3:a:phpnuke:php-nuke:7.8:::::::*
	cpe:2.3:a:phpnuke:php-nuke:7.9:::::::*

History

21 Nov 2024, 01:26

Type	Values Removed	Values Added
References	~~() http://www.openwall.com/lists/oss-security/2011/03/23/9 - Exploit~~	() http://www.openwall.com/lists/oss-security/2011/03/23/9 - Exploit
References	~~() http://www.openwall.com/lists/oss-security/2011/03/30/8 - Exploit~~	() http://www.openwall.com/lists/oss-security/2011/03/30/8 - Exploit
References	~~() http://yehg.net/lab/pr0js/advisories/%5Bphpnuke-8.x%5D_cross_site_request_forgery -~~	() http://yehg.net/lab/pr0js/advisories/%5Bphpnuke-8.x%5D_cross_site_request_forgery -

07 Nov 2023, 02:07

Type	Values Removed	Values Added
References	{'url': 'http://yehg.net/lab/pr0js/advisories/[phpnuke-8.x]_cross_site_request_forgery', 'name': 'http://yehg.net/lab/pr0js/advisories/[phpnuke-8.x]_cross_site_request_forgery', 'tags': ['Broken Link'], 'refsource': 'MISC'}	() http://yehg.net/lab/pr0js/advisories/%5Bphpnuke-8.x%5D_cross_site_request_forgery -

Information

Published : 2011-06-21 02:52

Updated : 2024-11-21 01:26

NVD link : CVE-2011-1482

Mitre link : CVE-2011-1482

CVE.ORG link : CVE-2011-1482

JSON object : View

Products Affected

phpnuke

php-nuke

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

6.8 /10