CVE-2007-1520
published 2007-03-20CVE-2007-1520: The cross-site request forgery (CSRF) protection in PHP-Nuke 8.0 and earlier does not ensure the SERVER superglobal is an array before validating the…
PriorityP419medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EPSS
0.78%
51.3th percentile
The cross-site request forgery (CSRF) protection in PHP-Nuke 8.0 and earlier does not ensure the SERVER superglobal is an array before validating the HTTP_REFERER, which allows remote attackers to conduct CSRF attacks.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| phpnuke | php-nuke | <= 8.0 | — |
| phpnuke | php-nuke | — | — |
| phpnuke | php-nuke | — | — |
| phpnuke | php-nuke | — | — |
| phpnuke | php-nuke | — | — |
| phpnuke | php-nuke | — | — |
| phpnuke | php-nuke | — | — |
| phpnuke | php-nuke | — | — |
| phpnuke | php-nuke | — | — |
| phpnuke | php-nuke | — | — |
| phpnuke | php-nuke | — | — |
| phpnuke | php-nuke | — | — |
| phpnuke | php-nuke | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
http://osvdb.org/34501http://phpfi.com/214668http://secunia.com/advisories/24629http://www.securityfocus.com/archive/1/462308/100/100/threadedhttp://www.securityfocus.com/archive/1/462575/100/0/threadedhttp://www.securityfocus.com/archive/1/462727/100/0/threadedhttp://www.ush.it/2007/03/09/php-nuke-wild-post-xss/http://www.wisec.it/ush/phpnukexss.htmlhttp://osvdb.org/34501http://phpfi.com/214668http://secunia.com/advisories/24629http://www.securityfocus.com/archive/1/462308/100/100/threadedhttp://www.securityfocus.com/archive/1/462575/100/0/threadedhttp://www.securityfocus.com/archive/1/462727/100/0/threadedhttp://www.ush.it/2007/03/09/php-nuke-wild-post-xss/http://www.wisec.it/ush/phpnukexss.html
2007-03-20
Published