{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-11-06T00:00:00", "descriptions": [{"lang": "en", "value": "Cross-site request forgery (CSRF) vulnerability in edit.php in the MS TopSites add-on for PHP-Nuke does not verify that the uname parameter matches the current account, which allows remote authenticated users to change arbitrary accounts or change the SiteTitleName field as an arbitrary user via a modified uname value in an edit action to modules.php."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-15T20:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "26358", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/26358"}, {"tags": ["x_refsource_MISC"], "url": "http://0x90.com.ar/Advisory/20071106.txt"}, {"name": "20071106 PhpNuke (add-on) MS TopSites Edit Exploit And Html Injection", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/483353/100/0/threaded"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2007-5918", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Cross-site request forgery (CSRF) vulnerability in edit.php in the MS TopSites add-on for PHP-Nuke does not verify that the uname parameter matches the current account, which allows remote authenticated users to change arbitrary accounts or change the SiteTitleName field as an arbitrary user via a modified uname value in an edit action to modules.php."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "26358", "refsource": "BID", "url": "http://www.securityfocus.com/bid/26358"}, {"name": "http://0x90.com.ar/Advisory/20071106.txt", "refsource": "MISC", "url": "http://0x90.com.ar/Advisory/20071106.txt"}, {"name": "20071106 PhpNuke (add-on) MS TopSites Edit Exploit And Html Injection", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/483353/100/0/threaded"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T15:47:00.500Z"}, "title": "CVE Program Container", "references": [{"name": "26358", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/26358"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://0x90.com.ar/Advisory/20071106.txt"}, {"name": "20071106 PhpNuke (add-on) MS TopSites Edit Exploit And Html Injection", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/483353/100/0/threaded"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2007-5918", "datePublished": "2007-11-10T02:00:00", "dateReserved": "2007-11-09T00:00:00", "dateUpdated": "2024-08-07T15:47:00.500Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ms_topsites:ms_topsites:*:*:*:*:*:*:*:*", "matchCriteriaId": "2D6FA7AD-D57D-489B-9083-54C64E920F4F", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross-site request forgery (CSRF) vulnerability in edit.php in the MS TopSites add-on for PHP-Nuke does not verify that the uname parameter matches the current account, which allows remote authenticated users to change arbitrary accounts or change the SiteTitleName field as an arbitrary user via a modified uname value in an edit action to modules.php."}, {"lang": "es", "value": "Vulnerabilidad en la falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF) en el edit.php del MS TopSites add-on para el PHP-Nuke, no verifica que el par\u00e1metro uname concuerde con la cuenta actual, lo que permite a usuarios remotos autenticados cambiar cuentas de su elecci\u00f3n o cambiar el campo SiteTitleName como un usuario de su elecci\u00f3n a trav\u00e9s de la modificaci\u00f3n del valor uname en una acci\u00f3n de edici\u00f3n (\"edit\") en el modules.php."}], "id": "CVE-2007-5918", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": true, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2007-11-10T02:46:00.000", "references": [{"source": "cve@mitre.org", "url": "http://0x90.com.ar/Advisory/20071106.txt"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/483353/100/0/threaded"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/26358"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://0x90.com.ar/Advisory/20071106.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/483353/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/26358"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}