CVE-2007-3331 Cross-site request forgery (CSRF) vulnerability in STphp EasyNews PRO 4.0 allows remote attackers to change the admin password via (1) a certain HTML form that is posted automatically by JavaScript or...
MediumCVSS 5.0
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site request forgery (CSRF) vulnerability in STphp EasyNews PRO 4.0 allows remote attackers to change the admin password via (1) a certain HTML form that is posted automatically by JavaScript or (2) a news post.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| stphp easynews | = 4.0 | No fix listed |
References
- 20070617 H4CREW-000005 EasyNews Pro 4.0 XSS & CSRF mailing-list
- 38617 vdb-entry
- 2829 third-party-advisory
- easynews-unspecified-csrf(34893) vdb-entry