medium6.8Public exploit code
CVE-2009-4907
Multiple cross-site request forgery (CSRF) vulnerabilities in oBlog allow remote attackers to hijack the authentication of administrators for requests that (1)…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- oBlog - Persistent Cross-Site Scripting / Cross-Site Request Forgery / Admin Brute Force2009-12-11 · webapps · php · Verified
Impact
Multiple cross-site request forgery (CSRF) vulnerabilities in oBlog allow remote attackers to hijack the authentication of administrators for requests that (1) change the admin password, (2) force an admin logout, (3) change the visibility of posts, (4) remove links, and (5) change the name fields of a blog.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dootzky | Oblog | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- http://osvdb.org/60907
- http://packetstormsecurity.org/0912-exploits/oblog-xssxsrf.txt
- http://secunia.com/advisories/37661
- https://exchange.xforce.ibmcloud.com/vulnerabilities/54714
- http://osvdb.org/60907
- http://packetstormsecurity.org/0912-exploits/oblog-xssxsrf.txt
- http://secunia.com/advisories/37661
- https://exchange.xforce.ibmcloud.com/vulnerabilities/54714