Published: 18/04/2014 Updated: 09/10/2018

CVSS v2 Base Score: 5.5 | Impact Score: 4.9 | Exploitability Score: 8

VMScore: 490

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:N

PHPFox 3.7.3 and 3.7.4 allows remote authenticated users to bypass intended "Only Me" restrictions and "like" a publication via a request that specifies the ID for the publication.

Vulnerable Product	Search on Vulmon	Subscribe to Product
phpfox phpfox 3.7.4
phpfox phpfox 3.7.3

PHPFox version 373, 374, and 375 suffer from an authorization bypass vulnerability ...

POC

CVE I realy love it!!! All these publications were my first, today I have a slightly different view of how I should have built this path, well, it's true that we have improved over time CVE-2014-8469 PHPFOX XSS ADMINCP CVE-2013-7196 Comment on a publication set to "Only Me" CVE-2013-7195 Flag as "like" a publication set to "Only Me" CVE-2013

CWE-264 http://www.securityfocus.com/bid/66672 https://exchange.xforce.ibmcloud.com/vulnerabilities/92335 http://www.securityfocus.com/archive/1/531745/100/0/threaded https://nvd.nist.gov https://github.com/wesleyleite/CVE https://packetstormsecurity.com/files/126035/PHPFox-3.7.5-Authorization-Bypass.html

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2013-7195

Vulnerability Summary

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect