CVE-2009-3520

HIGH

CMSphp 0.21 - Cross-Site Request Forgery via Admin Password Change

Title source: llm

Description

Cross-site request forgery (CSRF) vulnerability in the Your_account module in CMSphp 0.21 allows remote attackers to hijack the authentication of administrators for requests that change an administrator password via the pseudo, pwd, and uid parameters in an admin_info_user_verif action.

References (2)

Core 2

Core References

Broken Link, Exploit x_refsource_misc

http://packetstormsecurity.org/0909-exploits/cmsphp-xsrf.txt

Broken Link, Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/36075

Scores

CVSS v3 8.8

EPSS 0.0065

EPSS Percentile 46.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-352

Status published

Products (1)

cmsphp_project/cmsphp 0.21

Published Oct 01, 2009

Tracked Since Feb 18, 2026