CVE-2012-2930 Multiple cross-site request forgery (CSRF) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to hijack the authentication of administrators for requests that (1) add a user v...
MediumCVSS 6.8
EPSS 0.69%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to hijack the authentication of administrators for requests that (1) add a user via an adduser action to admin/index.php or (2) conduct static PHP code injection attacks in .htusers.php via the user parameter to admin/index.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tinywebgallery | <= 1.8.6 | No fix listed |
References
- 82961 vdb-entry
- www.tinywebgallery.com vendor-advisory
- www.htbridge.com exploit