CVE-2015-2142

Multiple cross-site request forgery (CSRF) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote authenticated users to (1) hijack the authentication of users for requests that cause an unspecified impact via the id parameter to project.php, (2) hijack the authentication of users for requests that cause an unspecified impact via the group_id parameter to group.php, (3) hijack the authentication of users for requests that delete statuses via the status_id parameter to status.php, (4) hijack the authentication of users for requests that delete severities via the severity_id parameter to severity.php, (5) hijack the authentication of users for requests that cause an unspecified impact via the priority_id parameter to priority.php, (6) hijack the authentication of users for requests that delete the operating system via the os_id parameter to os.php, (7) hijack the authentication of users for requests that delete databases via the database_id parameter to database.php, or (8) hijack the authentication of users for requests that delete sites via the site_id parameter to sites.php.

• CWE-352

• http://www.openwall.com/lists/oss-security/2015/02/28/1Mailing List, Third Party Advisory
• https://github.com/a-v-k/phpBugTracker/issues/4Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/02/28/1Mailing List, Third Party Advisory
• https://github.com/a-v-k/phpBugTracker/issues/4Third Party Advisory

Published

Oct 6, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-2136HP ArcSight Logger before 6.0 P2 allows remote authenticated…
• CVE-2015-2137Unspecified vulnerability in HP Operations Manager i (OMi) 9…
• CVE-2015-2138Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2015-2139HP Systems Insight Manager (SIM) before 7.5.0, as used in HP…
• CVE-2015-2140HP Systems Insight Manager (SIM) before 7.5.0, as used in HP…
• CVE-2015-2141The InvertibleRWFunction::CalculateInverse function in rw.cp…
• CVE-2015-2143Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2015-2144Multiple cross-site scripting (XSS) vulnerabilities in Issue…
• CVE-2015-2145Multiple cross-site scripting (XSS) vulnerabilities in Issue…
• CVE-2015-2146Multiple SQL injection vulnerabilities in Issuetracker phpBu…
• CVE-2015-2147Multiple SQL injection vulnerabilities in Issuetracker phpBu…
• CVE-2015-2148Multiple cross-site scripting (XSS) vulnerabilities in Issue…