CVE-2007-1925

CVE-2007-1925 describes a vulnerability in Tru-Zone Nuke ET 3.4 before fix 7, specifically within the borrado function in modules/Your_Account/index.php. This flaw allows remote authenticated users to delete arbitrary user accounts by manipulating a cookie, as the system fails to verify if the account deletion request originates from the legitimate account owner. With a CVSS score of 6.5, this vulnerability is of medium severity, indicating that an attacker can exploit it over a network with low complexity, requiring only authentication. The potential impact includes partial loss of confidentiality, integrity, and availability, as user accounts can be deleted without authorization. There is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Furthermore, the vulnerability has received minimal community attention, with no social media discussion or media coverage.