Auth bypass in Beaussier Roomphplanning

CVE-2009-4670

admin/delitem.php in RoomPHPlanning 1.6 does not require authentication, which allows remote attackers to (1) delete arbitrary users via the user parameter or (2) delete arbitrary rooms via the room parameter.

Vulnerability class: Broken Authentication

EPSS: 0.023 (81.3th percentile) — read the EPSS interpretation.

Affected products

Beaussier Roomphplanning — versions 1.6
N/a — versions n/a

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

cve@mitre.org (x_refsource_SECUNIA, third-party-advisory, Vendor Advisory)
cve@mitre.org (exploit, x_refsource_EXPLOIT-DB)