PHP Bookmarks Form Manipulation Vulnerability
BID:4178
Info
PHP Bookmarks Form Manipulation Vulnerability
| Bugtraq ID: | 4178 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 22 2002 12:00AM |
| Updated: | Feb 22 2002 12:00AM |
| Credit: | This issue was initially publicized via the Changelog for the product. |
| Vulnerable: |
PHP Bookmarks PHP Bookmarks 1.6 PHP Bookmarks PHP Bookmarks 1.5 PHP Bookmarks PHP Bookmarks 1.4 PHP Bookmarks PHP Bookmarks 1.3 PHP Bookmarks PHP Bookmarks 1.2 PHP Bookmarks PHP Bookmarks 1.1 |
| Not Vulnerable: |
PHP Bookmarks PHP Bookmarks 1.8 PHP Bookmarks PHP Bookmarks 1.7 |
Discussion
PHP Bookmarks Form Manipulation Vulnerability
PHP Bookmarks is an application for managing bookmarks. It is written in PHP and back-ended by MySQL. It will run on most Linux and Unix variants.
Vulnerable versions of PHP Bookmarks do not verify the origin of forms that are submitted by web users. This may allow an attacker to perform a form manipulation attack against the application.
Exploitation of this issue requires that the attacker saves a form locally, uses a text editor to manipulate data in form elements, and then submits the manipulated form.
It should be noted that PHP Bookmarks was not designed to be publicly accessible. However, the authors have implemented some security measures to enable a user to share their bookmarks via PHP Bookmarks, so some implementations may be vulnerable.
PHP Bookmarks is an application for managing bookmarks. It is written in PHP and back-ended by MySQL. It will run on most Linux and Unix variants.
Vulnerable versions of PHP Bookmarks do not verify the origin of forms that are submitted by web users. This may allow an attacker to perform a form manipulation attack against the application.
Exploitation of this issue requires that the attacker saves a form locally, uses a text editor to manipulate data in form elements, and then submits the manipulated form.
It should be noted that PHP Bookmarks was not designed to be publicly accessible. However, the authors have implemented some security measures to enable a user to share their bookmarks via PHP Bookmarks, so some implementations may be vulnerable.
Exploit / POC
PHP Bookmarks Form Manipulation Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
PHP Bookmarks Form Manipulation Vulnerability
Solution:
This issue has been addressed in PHP Bookmarks versions 1.7 and later.
PHP Bookmarks PHP Bookmarks 1.1
PHP Bookmarks PHP Bookmarks 1.2
PHP Bookmarks PHP Bookmarks 1.3
PHP Bookmarks PHP Bookmarks 1.4
PHP Bookmarks PHP Bookmarks 1.5
PHP Bookmarks PHP Bookmarks 1.6
Solution:
This issue has been addressed in PHP Bookmarks versions 1.7 and later.
PHP Bookmarks PHP Bookmarks 1.1
-
PHP Bookmarks phpbookmarks-1.8.tar.gz
http://devel.thcnet.net/phpbookmarks/phpbookmarks-1.8.tar.gz
PHP Bookmarks PHP Bookmarks 1.2
-
PHP Bookmarks phpbookmarks-1.8.tar.gz
http://devel.thcnet.net/phpbookmarks/phpbookmarks-1.8.tar.gz
PHP Bookmarks PHP Bookmarks 1.3
-
PHP Bookmarks phpbookmarks-1.8.tar.gz
http://devel.thcnet.net/phpbookmarks/phpbookmarks-1.8.tar.gz
PHP Bookmarks PHP Bookmarks 1.4
-
PHP Bookmarks phpbookmarks-1.8.tar.gz
http://devel.thcnet.net/phpbookmarks/phpbookmarks-1.8.tar.gz
PHP Bookmarks PHP Bookmarks 1.5
-
PHP Bookmarks phpbookmarks-1.8.tar.gz
http://devel.thcnet.net/phpbookmarks/phpbookmarks-1.8.tar.gz
PHP Bookmarks PHP Bookmarks 1.6
-
PHP Bookmarks phpbookmarks-1.8.tar.gz
http://devel.thcnet.net/phpbookmarks/phpbookmarks-1.8.tar.gz