CVE-2012-5891

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2012-5891
Multiple cross-site request forgery (CSRF) vulnerabilities in photo/pass.php in DAlbum 1.44 build 174 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add a user via an add action, (2) change user passwords via a change action, or (3) delete a user via a delete action.

6.8 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://osvdb.org/80745
http://packetstormsecurity.org/files/111402/Dalbum-144-Build-174-Cross-Site-Request-Forgery.html Exploit
http://www.exploit-db.com/exploits/18685 Exploit
http://osvdb.org/80745
http://packetstormsecurity.org/files/111402/Dalbum-144-Build-174-Cross-Site-Request-Forgery.html Exploit
http://www.exploit-db.com/exploits/18685 Exploit
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:dalbum:dalbum:*:174:*:*:*:*:*:*
cpe:2.3:a:dalbum:dalbum:1.03:*:*:*:*:*:*:*
cpe:2.3:a:dalbum:dalbum:1.3:*:*:*:*:*:*:*
cpe:2.3:a:dalbum:dalbum:1.04:*:*:*:*:*:*:*
cpe:2.3:a:dalbum:dalbum:1.05:*:*:*:*:*:*:*
cpe:2.3:a:dalbum:dalbum:1.06:*:*:*:*:*:*:*
cpe:2.3:a:dalbum:dalbum:1.07:*:*:*:*:*:*:*
cpe:2.3:a:dalbum:dalbum:1.08:*:*:*:*:*:*:*
cpe:2.3:a:dalbum:dalbum:1.09:*:*:*:*:*:*:*
cpe:2.3:a:dalbum:dalbum:1.10:*:*:*:*:*:*:*
cpe:2.3:a:dalbum:dalbum:1.20:*:*:*:*:*:*:*
cpe:2.3:a:dalbum:dalbum:1.21:*:*:*:*:*:*:*
cpe:2.3:a:dalbum:dalbum:1.22:*:*:*:*:*:*:*
cpe:2.3:a:dalbum:dalbum:1.22:sp2:*:*:*:*:*:*
cpe:2.3:a:dalbum:dalbum:1.22:sp3:*:*:*:*:*:*
cpe:2.3:a:dalbum:dalbum:1.22:sp4:*:*:*:*:*:*
cpe:2.3:a:dalbum:dalbum:1.22:sp5:*:*:*:*:*:*
cpe:2.3:a:dalbum:dalbum:1.22:sp6:*:*:*:*:*:*
cpe:2.3:a:dalbum:dalbum:1.22:sp7:*:*:*:*:*:*
cpe:2.3:a:dalbum:dalbum:1.31:*:*:*:*:*:*:*
cpe:2.3:a:dalbum:dalbum:1.32:*:*:*:*:*:*:*
cpe:2.3:a:dalbum:dalbum:1.33:*:*:*:*:*:*:*
cpe:2.3:a:dalbum:dalbum:1.34:*:*:*:*:*:*:*
cpe:2.3:a:dalbum:dalbum:1.35:*:*:*:*:*:*:*
History

21 Nov 2024, 01:45

Type Values Removed Values Added
References () http://osvdb.org/80745 - () http://osvdb.org/80745 -
References () http://packetstormsecurity.org/files/111402/Dalbum-144-Build-174-Cross-Site-Request-Forgery.html - Exploit () http://packetstormsecurity.org/files/111402/Dalbum-144-Build-174-Cross-Site-Request-Forgery.html - Exploit
References () http://www.exploit-db.com/exploits/18685 - Exploit () http://www.exploit-db.com/exploits/18685 - Exploit
Information

Published : 2012-11-17 21:55

Updated : 2024-11-21 01:45

NVD link : CVE-2012-5891

Mitre link : CVE-2012-5891

CVE.ORG link : CVE-2012-5891

JSON object : View

Products Affected

dalbum

  • dalbum
CWE
CWE-352

Cross-Site Request Forgery (CSRF)