PT-2018-4271 · Phpmyfaq · Phpmyfaq

Jinen Patel + 1 · Publicado 2018-08-28 · Atualizado 2018-11-01 · CVE-2014-6046

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 2.8.13

Description The issue allows remote attackers to hijack the authentication of unspecified users for various requests, including deleting active users, deleting open questions, activating users, publishing FAQs, adding or deleting Glossary, adding or deleting FAQ news, adding or deleting comments, or adding votes. This is due to improper validation of CSRF tokens or a lack of a CSRF token.

Recommendations For versions prior to 2.8.13, update to version 2.8.13 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive functions that are vulnerable to CSRF attacks until the update is applied.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2014-6046

Produtos afetados

Phpmyfaq

Referências · 5

• 🔥 https://exploit-db.com/exploits/34580 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6046 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-6046 · Nota de Segurança
• https://phpmyfaq.de/security/advisory-2014-09-16 · Aviso do Fabricante
• http://techdefencelabs.com/security-advisories.html · Nota