Unscored severity · published Jun 19, 2009
CVE-2009-2125
delete_bug.php in Elvin before 1.2.1 does not require administrative privileges, which allows remote authenticated users to bypass intended access restrictions and delete…
–
CVSS
1%
EPSS
No
On KEV
Description
delete_bug.php in Elvin before 1.2.1 does not require administrative privileges, which allows remote authenticated users to bypass intended access restrictions and delete arbitrary bugs.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
Elvinbts · Elvinbts
through 1.2.0; 1.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-2125
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-2125
Patch
http://bugs.elvinbts.org/show_bug.php?id=50
osvdb.org
http://osvdb.org/55101
Vendor Advisory
http://secunia.com/advisories/35430
More from Elvinbts
–
CVE-2009-2920
Multiple cross-site scripting (XSS) vulnerabilities in Elvin 1.2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) component and (2) priority parameters…
–
CVE-2009-2130
Elvin 1.2.0 allows remote attackers to read the PHP source code of (1) login.ei, (2) jump_bug.ei, or (3) create_account.ei in inc/ via a direct request
–
CVE-2009-2129
Cross-site request forgery (CSRF) vulnerability in login.php in Elvin 1.2.0 allows remote attackers to hijack the authentication of arbitrary users via a logout action
–
CVE-2009-2128
SQL injection vulnerability in close_bug.php in Elvin before 1.2.1 allows remote attackers to execute arbitrary SQL commands via the title (aka subject) field
–
CVE-2009-2127
Cross-site scripting (XSS) vulnerability in show_activity.php in Elvin 1.2.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter