CVE-2013-7196

static/ajax.php in PHPFox 3.7.3, 3.7.4, and 3.7.5 allows remote authenticated users to bypass intended "Only Me" restrictions and comment on a private publication via a request with a modified valitemid parameter for the publication...

CVE-2013-7195

PHPFox 3.7.3 and 3.7.4 allows remote authenticated users to bypass intended "Only Me" restrictions and "like" a publication via a request that specifies the ID for the publication...

Design/Logic Flaw

static/ajax.php in PHPFox 3.7.3, 3.7.4, and 3.7.5 allows remote authenticated users to bypass intended "Only Me" restrictions and comment on a private publication via a request with a modified valitemid parameter for the publication...

Design/Logic Flaw

PHPFox 3.7.3 and 3.7.4 allows remote authenticated users to bypass intended "Only Me" restrictions and "like" a publication via a request that specifies the ID for the publication...

CVE-2013-7195

PHPFox 3.7.3 and 3.7.4 allows remote authenticated users to bypass intended "Only Me" restrictions and "like" a publication via a request that specifies the ID for the publication...

CVE-2013-7196

static/ajax.php in PHPFox 3.7.3, 3.7.4, and 3.7.5 allows remote authenticated users to bypass intended "Only Me" restrictions and comment on a private publication via a request with a modified valitemid parameter for the publication...

CVE-2013-7195

PHPFox 3.7.3 and 3.7.4 contain an authorization bypass that lets remote authenticated users bypass the privacy setting "Only Me" for publications by crafting requests (e.g., like or comment) that specify the publication ID. The flaw arises in how doLike/comment.add processes item_id and related f...

CVE-2013-7196

PHPFox 3.7.3–3.7.5 contains a flaw in static/ajax.php that allows remote authenticated users to bypass the "Only Me" privacy setting and post a comment on private publications by manipulating the val[item_id] parameter. The root cause is insufficient access control in AJAX comment/like handling, ...

CVE-2013-7196: Undefined Security Weakness

static/ajax.php in PHPFox 3.7.3, 3.7.4, and 3.7.5 allows remote authenticated users to bypass intended "Only Me" restrictions and comment on a private publication via a request with a modified valitemid parameter for the publication...

CVE-2013-7195: Undefined Security Weakness

PHPFox 3.7.3 and 3.7.4 allows remote authenticated users to bypass intended "Only Me" restrictions and "like" a publication via a request that specifies the ID for the publication...

PT-2014-3285

Name of the Vulnerable Software and Affected Versions PHPFox versions 3.7.3 through 3.7.5 Description The issue allows remote authenticated users to bypass intended "Only Me" restrictions and comment on a private publication. This is achieved by sending a request with a modified valitem id...

PT-2014-3284

Name of the Vulnerable Software and Affected Versions PHPFox versions 3.7.3 through 3.7.4 Description The issue allows remote authenticated users to bypass intended "Only Me" restrictions and "like" a publication via a request that specifies the ID for the publication. Recommendations For PHPFox...

PHPFox访问控制安全限制绕过漏洞

Bugtraq ID:66677 CVE ID:CVE-2013-7196 PHPFox是社交网络脚本。。 phpFox存在一个安全漏洞，允许攻击者利用漏洞绕过安全限制执行未授权操作。 0 PHPFox 3.7.3 PHPFox 3.7.4 PHPFox 3.7.5 目前厂商已经发布了升级补丁以修复漏洞，请下载使用： www.phpfox.com coreajax=truecorecall=comment.addcoresecuritytoken=686f82ec43f7dcd92784ab36ab5cbfb7...

PHPFox访问控制安全限制绕过漏洞

Bugtraq ID:66672 CVE ID:CVE-2013-7195 PHPFox是社交网络脚本。 PHPFox 3.7.3, 3.7.4, 3.7.5在实现上存在安全限制绕过漏洞，攻击者可利用此漏洞PHPFox是社交网络脚本。 0 PHPFox 目前厂商已经发布了升级补丁以修复漏洞，请下载使用： www.phpfox.com amp;coreajax=trueamp;corecall=comment.addamp;coresecuritytoken=686f82ec43f7dcd92784ab36ab5cbfb7...

PHPFox access control security restriction bypass Vulnerability(CVE-2 0 1 3-7 1 9 5)-vulnerability warning-the black bar safety net

Affected system: PHPFox PHPFox Description: -------------------------------------------------------------------------------- BUGTRAQ ID: 6 6 6 7 2 CVECAN ID: CVE-2 0 1 3-7 1 9 5 PHPFox is a social network script. PHPFox 3.7.3, 3.7.4, 3.7.5 in the realization of the presence of security restrictio...

PHPFox - Access Control Security Bypass

PHPFox - Access Control Security Bypass source: https://www.securityfocus.com/bid/66677/info PHPFox is prone to a security-bypass vulnerability that may allow attackers to perform actions without proper authorization. Attackers can leverage this issue to bypass security restrictions and perform...

PHPFox 3.7.5 Authorization Bypass

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 CNA primary MITRE Corporation [email protected] Software Vendors PHPFox http://www.phpfox.com Product http://demo.phpfox.com Version: v3.7.3, v3.7.4 and v3.7.5 Research Wesley Henrique Leite wesleyhenrique \NOSPAM gmail \NOSPAM// com +...

PHPFox - Access Control Security Bypass

source: https://www.securityfocus.com/bid/66677/info PHPFox is prone to a security-bypass vulnerability that may allow attackers to perform actions without proper authorization. Attackers can leverage this issue to bypass security restrictions and perform unauthorized actions; this may aid in...

PHPFox 3.6.0 Cross Site Scripting

------------------------------------------------------------ Exploit Title: PHPFox v3.6.0 build6 Multiple Cross-Site Scripting vulnerabilities ------------------------------------------------------------ Author: BHG Security Center Date: Saturday, October 12, 2013 Vendor: http://www.phpfox.com...

PHPFox v3.6.0 (build3) Multiple SQL Injection vulnerabilities

------------------------------------------------------------ PHPFox v3.6.0 build3 Multiple SQL Injection vulnerabilities ------------------------------------------------------------ == Description == - Software link: http://www.phpfox.com - Affected versions: version 3.6.0 build3 is vulnerable...