CVE-2013-1468

high

Description

Cross-site request forgery (CSRF) vulnerability in the LocalFiles Editor plugin in Piwigo before 2.4.7 allows remote attackers to hijack the authentication of administrators for requests that create arbitrary PHP files via unspecified vectors.

References

https://www.htbridge.com/advisory/HTB23144

https://euvd.enisa.europa.eu/vulnerability/EUVD-2013-1504

http://www.osvdb.org/90504

http://www.exploit-db.com/exploits/24561

http://secunia.com/advisories/52228

http://piwigo.org/releases/2.4.7

http://piwigo.org/forum/viewtopic.php?id=21470

http://piwigo.org/bugs/view.php?id=0002844

http://packetstormsecurity.com/files/120592/Piwigo-2.4.6-Cross-Site-Request-Forgery-Traversal.html

http://archives.neohapsis.com/archives/bugtraq/2013-02/0153.html

Details

Source: Mitre, NVD

Published: 2013-03-14

Updated: 2026-06-16

Risk Information

CVSS v2

Base Score: 7.6

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 8.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H