CVE-2009-4907 EXPLOIT
6.8
MEDIUM · CVSS 2.0 · EPSS 1.1% (pctl 64)
Patch early
A public exploit exists.
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in oBlog allow remote attackers to hijack the authentication of administrators for requests that (1) change the admin password, (2) force an admin logout, (3) change the visibility of posts, (4) remove links, and (5) change the name fields of a blog.
Scoring
| CVSS | 6.8 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| EPSS | 1.08% — more likely to be exploited than 64% of all CVEs |
| Weakness | CWE-352 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2010-06-25 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| dootzky | oblog |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | oBlog - Persistent Cross-Site Scripting / Cross-Site Request Forgery / Admin Brute Force | 2009-12-11 |
References
- http://osvdb.org/60907
- http://packetstormsecurity.org/0912-exploits/oblog-xssxsrf.txt
- http://secunia.com/advisories/37661
- https://exchange.xforce.ibmcloud.com/vulnerabilities/54714
- http://osvdb.org/60907
- http://packetstormsecurity.org/0912-exploits/oblog-xssxsrf.txt
- http://secunia.com/advisories/37661
- https://exchange.xforce.ibmcloud.com/vulnerabilities/54714
→ the Explorer · watch your stack · NVD