CVE-2007-1364

Severity: medium (CVSS 6.4 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-04-11 · updated 2026-06-16

Description

DropAFew before 0.2.1 does not require authorization for certain privileged actions, which allows remote attackers to (1) view the logged calorie information of arbitrary users via the id parameter in editlogcal.php, (2) add arbitrary links via links.php, or (3) create arbitrary users via newaccount2.php.

Affected products

Dropafew: through 0.2

References

http://secunia.com/advisories/24861
http://www.dropafew.com/sphpblog/comments.php?y=07&m=04&entry=entry070403-224437
http://www.securityfocus.com/bid/23400
https://exchange.xforce.ibmcloud.com/vulnerabilities/33561
https://www.cynops.de/advisories/CVE-2007-1363.txt
http://secunia.com/advisories/24861
http://www.dropafew.com/sphpblog/comments.php?y=07&m=04&entry=entry070403-224437
http://www.securityfocus.com/bid/23400
https://exchange.xforce.ibmcloud.com/vulnerabilities/33561
https://www.cynops.de/advisories/CVE-2007-1363.txt

Get alerted when CVE-2007-1364 or the next vulnerability affects your stack