CVE-2007-4143
user.php in the Billing Control Panel in phpCoupon allows remote authenticated users to obtain Premium Member status, and possibly acquire free coupons, via a modified URL containing a certain billing parameter and REQ=auth, status=success, and…
Does this matter?
Lower severity and a low EPSS score (4.16%). Track it; it rarely justifies an emergency change on its own.
Description
user.php in the Billing Control Panel in phpCoupon allows remote authenticated users to obtain Premium Member status, and possibly acquire free coupons, via a modified URL containing a certain billing parameter and REQ=auth, status=success, and custom=upgrade substrings, possibly related to PayPal transactions.
- CVSS 2.0
- 4.0 MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:N
- EPSS
- 4.16% probability · 90th percentile
- CISA KEV
- Not listed
- Affected
- phpcoupon/phpcoupon
- Source
- cve@mitre.org
References
- http://securityreason.com/securityalert/2958
- http://www.securityfocus.com/archive/1/474936/100/0/threaded
- http://www.securityfocus.com/bid/25116Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/35664
- http://securityreason.com/securityalert/2958
- http://www.securityfocus.com/archive/1/474936/100/0/threaded
- http://www.securityfocus.com/bid/25116Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/35664
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.