Vcard 2.9 and possibly other versions does not require authorization to run uninstall.php, which could allow remote attackers to uninstall Vcard and delete database tables via a direct request to uninstall.php.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Vcard | Belchior_foundry | 2.8 (including) | 2.8 (including) |
| Vcard | Belchior_foundry | 2.9 (including) | 2.9 (including) |
References
- http://marc.info/?l=bugtraq\u0026m=107957312531199\u0026w=2
- http://www.securityfocus.com/bid/9910
- https://exchange.xforce.ibmcloud.com/vulnerabilities/15522
- http://marc.info/?l=bugtraq\u0026m=107957312531199\u0026w=2
- http://www.securityfocus.com/bid/9910
- https://exchange.xforce.ibmcloud.com/vulnerabilities/15522