CVE-2007-5229

Feedburner Feedsmith - CSRF

Title source: rule

Description

Cross-site request forgery (CSRF) vulnerability in the FeedBurner FeedSmith 2.2 plugin for WordPress allows remote attackers to change settings and hijack blog feeds via a request to wp-admin/options-general.php that submits parameter values to FeedBurner_FeedSmith_Plugin.php, as demonstrated by the (1) feedburner_url and (2) feedburner_comments_url parameters.

Exploits (1)

exploitdb WORKING POC VERIFIED

by David Kierznowski · javascriptwebappsphp

https://www.exploit-db.com/exploits/30637

View Code ZIP pw:eip

References (8)

[Various Sources] http://blogs.feedburner.com/feedburner/archives/2007/10/the_feedsmith_plugin_newly_for.php

[Exploit] http://blogsecurity.net/wordpress/feedburner-feed-hijacking/

[Various Sources] http://blogsecurity.net/wordpress/feedsmith-feedburner-vulnerability-fixed/

[Exploit] http://marc.info/?l=full-disclosure&m=119145344606493&w=2

[Patch, Vendor Advisory] http://secunia.com/advisories/27055

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/36940

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/25921

[Exploit, Third Party Advisory] https://www.exploit-db.com/exploits/30637/

Scores

EPSS 0.0327

EPSS Percentile 87.0%

Classification

CWE

CWE-352

Status draft

Affected Products (1)

feedburner/feedsmith

Timeline

Published Oct 05, 2007

Tracked Since Feb 18, 2026