CVE-2007-1364

Published: Apr 11, 2007Modified: Apr 23, 2026

6.4

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Exploitability: 10.0 / Impact: 4.9

Source: NVD

Description

DropAFew before 0.2.1 does not require authorization for certain privileged actions, which allows remote attackers to (1) view the logged calorie information of arbitrary users via the id parameter in editlogcal.php, (2) add arbitrary links via links.php, or (3) create arbitrary users via newaccount2.php.

Affected (1)

Products: Dropafew: Dropafew

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Dropafew Dropafew	version ≤ 0.2

References (10)

http://secunia.com/advisories/24861

Source: cve@mitre.org

Vendor Advisory

http://www.dropafew.com/sphpblog/comments.php?y=07&m=04&entry=entry070403-224437

Source: cve@mitre.org

Patch

http://www.securityfocus.com/bid/23400

Source: cve@mitre.org

Exploit

https://exchange.xforce.ibmcloud.com/vulnerabilities/33561

Source: cve@mitre.org

https://www.cynops.de/advisories/CVE-2007-1363.txt

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/24861

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.dropafew.com/sphpblog/comments.php?y=07&m=04&entry=entry070403-224437

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://www.securityfocus.com/bid/23400

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

https://exchange.xforce.ibmcloud.com/vulnerabilities/33561

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.cynops.de/advisories/CVE-2007-1363.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.