PT-2019-7251 · 6Kbbs · 6Kbbs

Wang Jing · Publicado 2019-08-08 · Atualizado 2019-08-15 · CVE-2015-9292

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions 6kbbs versions 7.1 through 8.0

Description The issue allows for CSRF attacks via specific API endpoints, including "portalchannel ajax.php" with id or code parameters, and "admin.php" with a fileids parameter.

Recommendations For versions 7.1 and 8.0, consider restricting access to the "portalchannel ajax.php" and "admin.php" endpoints to minimize the risk of exploitation. As a temporary workaround, avoid using the id, code, and fileids parameters in the affected API endpoints until the issue is resolved.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2015-9292

Produtos afetados

6Kbbs

Referências · 5

• 🔥 https://cxsecurity.com/issue/WLB-2015040034 · Exploit
• https://t.me/cibsecurity/6165 · Publicação no Telegram
• https://t.me/cibsecurity/6016 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2015-9292 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9292 · Nota