CVE-2009-3520

Cross-site request forgery (CSRF) vulnerability in the Your_account module in CMSphp 0.21 allows remote attackers to hijack the authentication of administrators for requests that change an administrator password via the pseudo, pwd, and uid parameters in an admin_info_user_verif action.

Score

CVSS 3.1 8.8 High

Status

Modified - cve@mitre.org

Published

2009-10-01

Last modified

2024-09-16

Weaknesses

CWE-352

Affected products

• Cmsphp (Cmsphp Project)

References

• http://packetstormsecurity.org/0909-exploits/cmsphp-xsrf.txt
• http://secunia.com/advisories/36075