Vulnerability Description
admin/send_mod.php in Gregory Kokanosky phpMyNewsletter 0.8 beta5 and earlier prints a Location header but does not exit when administrative credentials are missing, which allows remote attackers to compose an e-mail message via a post with the subject, message, format, and list_id fields; and send the message via a direct request for the MsgId value under admin/.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gregory Kokanosky | Phpmynewsletter | <= 0.8_beta_5 |
References
- http://www.securityfocus.com/bid/23342Exploit
- https://www.exploit-db.com/exploits/3671
- http://www.securityfocus.com/bid/23342Exploit
- https://www.exploit-db.com/exploits/3671
FAQ
What is CVE-2007-2372?
CVE-2007-2372 is a vulnerability with a CVSS score of 10.0 (HIGH). admin/send_mod.php in Gregory Kokanosky phpMyNewsletter 0.8 beta5 and earlier prints a Location header but does not exit when administrative credentials are missing, which allows remote attackers to c...
How severe is CVE-2007-2372?
CVE-2007-2372 has been rated HIGH with a CVSS base score of 10.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2007-2372?
Check the references section above for vendor advisories and patch information. Affected products include: Gregory Kokanosky Phpmynewsletter.