PT-2015-3652 · Stark · Stark Crm

Gjoko Krstic · Publicado 2015-01-13 · Atualizado 2017-09-08 · CVE-2014-10008

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Stark CRM version 1.0

Description The issue allows remote attackers to hijack the authentication of administrators for various requests. This can be achieved through crafted requests to specific pages, including the admin page, agent page, sub agent page, partner page, or client page.

Recommendations For Stark CRM version 1.0, consider disabling the affected pages temporarily to minimize the risk of exploitation. Restrict access to these pages until a fix is available. Avoid using the affected functionality in the admin, agent, sub agent, partner, and client pages until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2014-10008

Produtos afetados

Stark Crm

Referências · 7

• 🔥 https://exploit-db.com/exploits/31792 · Exploit
• 🔥 http://zeroscience.mk/en/vulnerabilities/ZSL-2014-5169.php · Exploit
• 🔥 http://zeroscience.mk/codes/starkcrm_mv.txt · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/91267 · Nota
• http://secunia.com/advisories/57048 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-10008 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/91268 · Nota