medium5.0Public exploit code

CVE-2004-2364

Cross-site request forgery (CSRF) vulnerability in PHPX 3.0 through 3.2.6 allows remote attackers to execute arbitrary commands via URLs that are automatically…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

PHPX 3.x - '/forums.php' Cross-Site Request Forgery / Arbitrary Command Execution2004-05-05 · webapps · php · Verified
PHPX 3.x - '/images.php' Cross-Site Request Forgery / Arbitrary Command Execution2004-05-05 · webapps · php · Verified
PHPX 3.x - '/user.php' Cross-Site Request Forgery / Arbitrary Command Execution2004-05-05 · webapps · php · Verified
PHPX 3.x - '/news.php' Cross-Site Request Forgery / Arbitrary Command Execution2004-05-05 · webapps · php · Verified
PHPX 3.x - '/page.php' Cross-Site Request Forgery / Arbitrary Command Execution2004-05-05 · webapps · php · Verified
PHPX < 3.26 - Multiple Vulnerabilities2004-05-04 · webapps · php

Impact

Cross-site request forgery (CSRF) vulnerability in PHPX 3.0 through 3.2.6 allows remote attackers to execute arbitrary commands via URLs that are automatically executed on behalf of the administrator, as demonstrated using (1) admin/page.php, (2) admin/news.php, (3) admin/user.php, (4) admin/images.php, (5) admin/page.php, or (6) admin/forums.php.

Affected products

Vendor	Product	Affected versions
Phpx	Phpx	Versions 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5

Public exploit code

Impact

Affected products

References