high7.5Public exploit code
CVE-2009-2328
admin/edit_user.php in KerviNet Forum 1.1 and earlier does not require administrative authentication, which allows remote attackers to delete arbitrary account…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- kervinet forum 1.1 - Multiple Vulnerabilities2009-07-01 · webapps · php · Verified
Impact
admin/edit_user.php in KerviNet Forum 1.1 and earlier does not require administrative authentication, which allows remote attackers to delete arbitrary accounts and conduct SQL injection attacks via the del_user_id parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Max Kervin | Kervinet Forum | through 1.1 |