CVE-2007-0873 Missing authorization in n/a
Remote attackers can bypass authentication to access administrative functions in Nabopoll by directly requesting specific admin scripts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2007-0873?
CVE-2007-0873 is a high-severity missing authorization vulnerability in n/a, published on 12 Feb 2007. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
nabopoll 1.1.2 allows remote attackers to bypass authentication and access certain administrative functionality via a direct request for (1) config_edit.php, (2) template_edit.php, or (3) survey_edit.php in admin/.
Which versions are affected by CVE-2007-0873?
It affects 1 product.
Products include Nabocorp Nabopoll.
How do I fix CVE-2007-0873?
No fix has been published for CVE-2007-0873 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2007-0873 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2007-0873 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as GHSA-wqff-3wch-48w9.