CVEvulnerability
CVE-2007-1364
6.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2007-04-11
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.4 MEDIUM — AV:N/AC:L/Au:N/C:P/I:P/A:N
Description
DropAFew before 0.2.1 does not require authorization for certain privileged actions, which allows remote attackers to (1) view the logged calorie information of arbitrary users via the id parameter in editlogcal.php, (2) add arbitrary links via links.php, or (3) create arbitrary users via newaccount2.php.
Affected configurations
• dropafew dropafew (<= 0.2)
References
- http://secunia.com/advisories/24861 Vendor Advisory
- http://www.dropafew.com/sphpblog/comments.php?y=07&m=04&entry=entry070403-224437 Patch
- http://www.securityfocus.com/bid/23400 Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/33561 exchange.xforce.ibmcloud.com
- https://www.cynops.de/advisories/CVE-2007-1363.txt Vendor Advisory
- http://secunia.com/advisories/24861 Vendor Advisory
- http://www.dropafew.com/sphpblog/comments.php?y=07&m=04&entry=entry070403-224437 Patch
- http://www.securityfocus.com/bid/23400 Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/33561 exchange.xforce.ibmcloud.com
- https://www.cynops.de/advisories/CVE-2007-1363.txt Vendor Advisory