CVE-2007-5918 Cross-site request forgery in n/a
Authenticated users can exploit CSRF in MS TopSites to modify arbitrary account details or site titles by manipulating the uname parameter.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2007-5918?
CVE-2007-5918 is a medium-severity vulnerability in n/a, published on 10 Nov 2007. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Cross-site request forgery (CSRF) vulnerability in edit.php in the MS TopSites add-on for PHP-Nuke does not verify that the uname parameter matches the current account, which allows remote authenticated users to change arbitrary accounts or change the SiteTitleName field as an arbitrary user via a modified uname value in an edit action to modules.php.
Weakness: CWE-352
Which versions are affected by CVE-2007-5918?
It affects 1 product.
Products include Ms Topsites Ms Topsites.
How do I fix CVE-2007-5918?
No fix has been published for CVE-2007-5918 yet. Limit exposure of the affected software until one is available.
Is CVE-2007-5918 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2007-5918 exists.
Public exploit code: 1 Exploit-DB entry.
Sources
Also known as GHSA-hm64-99f5-q8f6.