CVE-2007-1364 EXPLOIT
6.4
MEDIUM · CVSS 2.0 · EPSS 2.2% (pctl 82)
Patch early
A public exploit exists.
Description
DropAFew before 0.2.1 does not require authorization for certain privileged actions, which allows remote attackers to (1) view the logged calorie information of arbitrary users via the id parameter in editlogcal.php, (2) add arbitrary links via links.php, or (3) create arbitrary users via newaccount2.php.
Scoring
| CVSS | 6.4 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:N |
| EPSS | 2.25% — more likely to be exploited than 82% of all CVEs |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2007-04-11 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| dropafew | dropafew |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | DropAFew 0.2 - 'newaccount2.php' Arbitrary Account Creation | 2007-04-10 |
References
- http://secunia.com/advisories/24861
- http://www.dropafew.com/sphpblog/comments.php?y=07&m=04&entry=entry070403-224437
- http://www.securityfocus.com/bid/23400
- https://exchange.xforce.ibmcloud.com/vulnerabilities/33561
- https://www.cynops.de/advisories/CVE-2007-1363.txt
- http://secunia.com/advisories/24861
- http://www.dropafew.com/sphpblog/comments.php?y=07&m=04&entry=entry070403-224437
- http://www.securityfocus.com/bid/23400
- https://exchange.xforce.ibmcloud.com/vulnerabilities/33561
- https://www.cynops.de/advisories/CVE-2007-1363.txt
→ the Explorer · watch your stack · NVD