CVE-2007-5918

Severity: medium (CVSS 6.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-11-10 · updated 2026-06-16
Weakness: CWE-352

Description

Cross-site request forgery (CSRF) vulnerability in edit.php in the MS TopSites add-on for PHP-Nuke does not verify that the uname parameter matches the current account, which allows remote authenticated users to change arbitrary accounts or change the SiteTitleName field as an arbitrary user via a modified uname value in an edit action to modules.php.

Affected products

Ms Topsites: all versions

References

http://0x90.com.ar/Advisory/20071106.txt
http://www.securityfocus.com/archive/1/483353/100/0/threaded
http://www.securityfocus.com/bid/26358
http://0x90.com.ar/Advisory/20071106.txt
http://www.securityfocus.com/archive/1/483353/100/0/threaded
http://www.securityfocus.com/bid/26358

Get alerted when CVE-2007-5918 or the next vulnerability affects your stack