Active PHP Bookmarks Arbitrary Bookmark Addition Vulnerability

Bugtraq ID:	6546
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 06 2003 12:00AM
Updated:	Jan 06 2003 12:00AM
Credit:	Discovery of this issue is credited to <[email protected]>.
Vulnerable:	Active PHP Bookmarks Active PHP Bookmarks 1.1 .01
Not Vulnerable:

Active PHP Bookmarks Arbitrary Bookmark Addition Vulnerability

Active PHP Bookmarks (APB) is prone to a vulnerability which may allow a remote attacker to add bookmarks arbitrarily.

The user ID is stored in a hidden form field of the add_bookmark form. An attacker may submit this form with an arbitrary value in the appropriate form field. This will permit the remote attacker to add bookmarks for any user.

Active PHP Bookmarks Arbitrary Bookmark Addition Vulnerability

There is no exploit code required.

Active PHP Bookmarks Arbitrary Bookmark Addition Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Active PHP Bookmarks Arbitrary Bookmark Addition Vulnerability

References:

• Active PHP Bookmarks Homepage (Active PHP Bookmarks)
  
• Bookmar4U and Active PHP Bookmarks Vulnerabilities ()