Authentication flaw

2010-03-0518:30:00

PRIOn knowledge base

www.prio-n.com

7.3 High

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

77.4%

JSON

admin/delitem.php in RoomPHPlanning 1.6 does not require authentication, which allows remote attackers to (1) delete arbitrary users via the user parameter or (2) delete arbitrary rooms via the room parameter.

CPENameOperatorVersion
roomphplanningeq1.6

CPE	Name	Operator	Version
	roomphplanning	eq	1.6

References

secunia.com/advisories/35237

www.exploit-db.com/exploits/8797