CVE-2004-2364

28Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 11%

from disclosure to weapon0 days

Published on NVDAug 16

1st PoCMay 4

exploitation probability

11%top 5% of all CVEs

observed exploitation

nono source reports it

6 public exploit(s)

Cross-site request forgery (CSRF) vulnerability in PHPX 3.0 through 3.2.6 allows remote attackers to execute arbitrary commands via URLs that are automatically executed on behalf of the administrator, as demonstrated using (1) admin/page.php, (2) admin/news.php, (3) admin/user.php, (4) admin/images.php, (5) admin/page.php, or (6) admin/forums.php.

Affected products

n/a · n/a

public PoCs found — 6✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/24091 exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/24089 exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/24088 exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/24090 exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/24092 exploitdbwww.exploit-db.com/exploits/43812unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://secunia.com/advisories/11554 http://securitytracker.com/id?1010061 http://www.osvdb.org/5907 http://www.osvdb.org/5908 http://www.osvdb.org/5909 http://www.osvdb.org/5910 http://www.osvdb.org/5911 http://www.phpx.org/project.php?action=view&project_id=1 http://www.securityfocus.com/archive/1/362230 http://www.securityfocus.com/bid/10284