PT-2012-3242 · Socialcms · Socialcms

Ivano Binetti · Publicado 2012-10-08 · Atualizado 2017-08-29 · CVE-2012-1416

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SocialCMS version 1.0.2

Description The issue concerns multiple cross-site request forgery (CSRF) vulnerabilities. These vulnerabilities allow remote attackers to hijack the authentication of administrators for specific requests. The requests in question are those that add administrator accounts via a "member new" action to "my admin/admin1 members.php" or modify the default site title via a "save" action to "my admin/admin1 configuration.php".

Recommendations For SocialCMS version 1.0.2, as a temporary workaround, consider restricting access to the "my admin/admin1 members.php" and "my admin/admin1 configuration.php" files to minimize the risk of exploitation. Avoid using the "member new" and "save" actions in these files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2012-1416

Produtos afetados

Socialcms

Referências · 8

• 🔥 https://exploit-db.com/exploits/18487 · Exploit
• 🔥 http://exploit-db.com/exploits/18487 · Exploit
• 🔥 http://exploit-db.com/exploits/17193 · Exploit
• 🔥 https://exploit-db.com/exploits/17193 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66985 · Nota
• http://secunia.com/advisories/44313 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-1416 · Nota de Segurança
• http://osvdb.org/71930 · Nota