CVE-2007-1364 | BDVDB-2026-23407 Detail

Description#

DropAFew before 0.2.1 does not require authorization for certain privileged actions, which allows remote attackers to (1) view the logged calorie information of arbitrary users via the id parameter in editlogcal.php, (2) add arbitrary links via links.php, or (3) create arbitrary users via newaccount2.php.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://www.dropafew.com/sphpblog/comments.php?y=07&m=04&entry=entry070403-224437
http://secunia.com/advisories/24861
https://exchange.xforce.ibmcloud.com/vulnerabilities/33561
http://www.securityfocus.com/bid/23400
https://www.cynops.de/advisories/CVE-2007-1363.txt

Exploit#

No public exploit known

History#

Version 12007-04-11Record published in the CVE List.
Version 22024-08-07Most recent update recorded in the CVE List.