Cross-Site Request Forgery Vulnerabilities in TinyWebGallery by TinyWebGallery

CVE-2012-2930

What is CVE-2012-2930?

TinyWebGallery versions prior to 1.8.8 are susceptible to multiple cross-site request forgery (CSRF) vulnerabilities. These vulnerabilities enable attackers to exploit the authentication tokens of administrators, facilitating unauthorized actions such as adding users through admin functionality or executing static PHP code injection attacks via the .htusers.php file. This poses a significant security risk, allowing malicious actors to manipulate administrative capabilities without valid authentication.

References