vulnwire
6.4med

CVE-2007-13641 exploit

DropAFew before 0.2.1 does not require authorization for certain privileged actions, which allows remote attackers to (1) view the logged c…

Published 19 y ago · modified 4 mo ago · JSON

CVSS
6.4
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.2%
percentile 83%
Public exploits
1
Exploit-DB

DropAFew before 0.2.1 does not require authorization for certain privileged actions, which allows remote attackers to (1) view the logged calorie information of arbitrary users via the id parameter in editlogcal.php, (2) add arbitrary links via links.php, or (3) create arbitrary users via newaccount2.php.

Exploit prediction (EPSS)

2.25% probability of exploitation in the next 30 days, higher than 83% of all scored CVEs.

Exploits and detections

  • EDB-29831 DropAFew 0.2 - 'newaccount2.php' Arbitrary Account Creation · webapps · 2007-04-10

CVSS scores

Assigned byVersionScoreVector
NVD2.06.4AV:N/AC:L/Au:N/C:P/I:P/A:N

References

  • dropafew.com /sphpblog/comments.php?y=07&m=04&entry=entry070403-224437 · x_refsource_CONFIRM, x_transferred
  • secunia.com /advisories/24861 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/33561 · vdb-entry, x_refsource_XF, x_transferred
  • securityfocus.com /bid/23400 · vdb-entry, x_refsource_BID, x_transferred
  • cynops.de /advisories/CVE-2007-1363.txt · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.