Vulnerability Description
admin/edit_user.php in KerviNet Forum 1.1 and earlier does not require administrative authentication, which allows remote attackers to delete arbitrary accounts and conduct SQL injection attacks via the del_user_id parameter.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Max Kervin | Kervinet Forum | <= 1.1 |
Related Weaknesses (CWE)
References
FAQ
What is CVE-2009-2328?
CVE-2009-2328 is a vulnerability with a CVSS score of 7.5 (HIGH). admin/edit_user.php in KerviNet Forum 1.1 and earlier does not require administrative authentication, which allows remote attackers to delete arbitrary accounts and conduct SQL injection attacks via t...
How severe is CVE-2009-2328?
CVE-2009-2328 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2009-2328?
Check the references section above for vendor advisories and patch information. Affected products include: Max Kervin Kervinet Forum.