« Volver al listado

CVE-2007-1520

Estado: ModificadaMedia (6.8)—

The cross-site request forgery (CSRF) protection in PHP-Nuke 8.0 and earlier does not ensure the SERVER superglobal is an array before validating the HTTP_REFERER, which allows remote attackers to conduct CSRF attacks.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Phpnuke — Php-nuke

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2007-1520",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-03-20T20:19:00.000",
  "references": [
    {
      "url": "http://osvdb.org/34501",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://phpfi.com/214668",
      "tags": [
        "Exploit",
        "URL Repurposed"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/24629",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/462308/100/100/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/462575/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/462727/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.ush.it/2007/03/09/php-nuke-wild-post-xss/",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.wisec.it/ush/phpnukexss.html",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/34501",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://phpfi.com/214668",
      "tags": [
        "Exploit",
        "URL Repurposed"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/24629",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/462308/100/100/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/462575/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/462727/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ush.it/2007/03/09/php-nuke-wild-post-xss/",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.wisec.it/ush/phpnukexss.html",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The cross-site request forgery (CSRF) protection in PHP-Nuke 8.0 and earlier does not ensure the SERVER superglobal is an array before validating the HTTP_REFERER, which allows remote attackers to conduct CSRF attacks."
    },
    {
      "lang": "es",
      "value": "La protección de cross-site request forgery (CSRF) en PHP-Nuke versión 8.0 y anteriores, no garantiza que la superglobal SERVER sea una matriz antes de validar la HTTP_REFERER, que permite a los atacantes remotos realizar ataques CSRF."
    }
  ],
  "lastModified": "2026-06-16T22:37:44.977",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:phpnuke:php-nuke:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A2A43B27-19D2-4118-B80E-8E225C34BFB1",
              "versionEndIncluding": "8.0"
            },
            {
              "criteria": "cpe:2.3:a:phpnuke:php-nuke:5.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F42BD4C3-71D7-48E2-B3A4-7B1975982D5E"
            },
            {
              "criteria": "cpe:2.3:a:phpnuke:php-nuke:6.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EDEA81E1-E9E9-45F6-8C61-D496888451E3"
            },
            {
              "criteria": "cpe:2.3:a:phpnuke:php-nuke:7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D5E8572B-43BE-4068-929F-2B6FAA9EF959"
            },
            {
              "criteria": "cpe:2.3:a:phpnuke:php-nuke:7.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F8882C59-6721-4925-8EB6-1C54455BD03B"
            },
            {
              "criteria": "cpe:2.3:a:phpnuke:php-nuke:7.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C6F6110-F77B-42CE-BAD0-0AEAFC04E982"
            },
            {
              "criteria": "cpe:2.3:a:phpnuke:php-nuke:7.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "017A5AD3-CD1C-41E0-B53D-3881C31F7463"
            },
            {
              "criteria": "cpe:2.3:a:phpnuke:php-nuke:7.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "68BA9153-537A-4CC5-A3E8-DE4FCF49EB52"
            },
            {
              "criteria": "cpe:2.3:a:phpnuke:php-nuke:7.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C7481433-4DFA-4D32-BA93-FBEAC37D8D67"
            },
            {
              "criteria": "cpe:2.3:a:phpnuke:php-nuke:7.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "85535C0D-C858-4AF8-8350-EFBF74609CBB"
            },
            {
              "criteria": "cpe:2.3:a:phpnuke:php-nuke:7.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7CC4F979-7F10-4F0D-96AD-5EE88E437897"
            },
            {
              "criteria": "cpe:2.3:a:phpnuke:php-nuke:7.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3A3B4A35-6019-468E-89FA-BC2EEADB7D31"
            },
            {
              "criteria": "cpe:2.3:a:phpnuke:php-nuke:7.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "575CFD4C-90CB-4D38-94F9-3D7915B2F054"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}