PT-2018-10619 · Mybb · Moderator Log Notes Plugin

0Xb9 · Publicado 2018-08-24 · Atualizado 2018-10-31 · CVE-2018-11502

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Moderator Log Notes plugin version 1.1 for MyBB

Description The issue allows an attacker to remotely delete all moderator notes and logs in the moderator control panel (modCP) and administrator control panel (ACP) via a Cross-Site Request Forgery (CSRF) attack. This enables unauthorized modification of sensitive data.

Recommendations For Moderator Log Notes plugin version 1.1, consider implementing CSRF protection mechanisms to prevent unauthorized requests. As a temporary workaround, restrict access to the modCP and ACP to minimize the risk of exploitation.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2018-11502

Produtos afetados

Moderator Log Notes Plugin

Referências · 4

• 🔥 https://exploit-db.com/exploits/45224 · Exploit
• 🔥 https://packetstormsecurity.com/files/148999/MyBB-Moderator-Log-Notes-1.1-Cross-Site-Request-Forgery.html · Exploit
• https://osv.dev/vulnerability/CVE-2018-11502 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-11502 · Nota de Segurança