PT-2014-3385 · B2Evolution · B2Evolution

Publicado 2014-04-02 · Atualizado 2014-04-03 · CVE-2013-7352

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions b2evolution versions prior to 4.1.7

Description A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the show statuses[] parameter.

Recommendations For versions prior to 4.1.7, update to version 4.1.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the blogs/admin.php endpoint to minimize the risk of exploitation. Avoid using the show statuses[] parameter in the affected endpoint until the issue is resolved.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2013-7352

Produtos afetados

B2Evolution

Referências · 7

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2013-05/0004.html · Exploit
• 🔥 http://packetstormsecurity.com/files/121481/b2evolution-4.1.6-SQL-Injection.html · Exploit
• 🔥 https://htbridge.com/advisory/HTB23152 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7352 · Nota
• http://b2evolution.net/news/2013/04/29/b2evolution-4-1-7-and-5-0-3 · Aviso do Fabricante
• http://osvdb.org/show/osvdb/92906 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-7352 · Nota de Segurança