CVE-2009-4385

Multiple cross-site request forgery (CSRF) vulnerabilities in Scriptsez.net Ez Poll Hoster (EPH) allow remote attackers to (1) hijack the authentication of arbitrary users for requests that delete polls via the delete_poll action to index.php; and hijack the authentication of administrators for requests that (2) delete users via the manage action to admin.php, or (3) send arbitrary email to arbitrary users in the email action to admin.php.

CVSS v2.0

6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

0.97% chance of exploitation in the next 30 days, 59th percentile

Published

2009-12-22

Updated

2024-08-07

Proof-of-concept exploits (1)

• http://www.exploit-db.com/exploits/10439

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/10439

References

• CVE Record
• NVD entry

Related

• CVE-2009-4384
• CVE-2009-4386
• CVE-2009-4382
• CVE-2009-4403
• CVE-2009-4381
• CVE-2009-4413