PT-2012-3242 · Socialcms · Socialcms

Ivano Binetti · Published 2012-10-08 · Updated 2017-08-29 · CVE-2012-1416

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SocialCMS version 1.0.2

Description The issue concerns multiple cross-site request forgery (CSRF) vulnerabilities. These vulnerabilities allow remote attackers to hijack the authentication of administrators for specific requests. The requests in question are those that add administrator accounts via a "member new" action to "my admin/admin1 members.php" or modify the default site title via a "save" action to "my admin/admin1 configuration.php".

Recommendations For SocialCMS version 1.0.2, as a temporary workaround, consider restricting access to the "my admin/admin1 members.php" and "my admin/admin1 configuration.php" files to minimize the risk of exploitation. Avoid using the "member new" and "save" actions in these files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2012-1416

Affected Products

Socialcms

References · 8

• 🔥 https://exploit-db.com/exploits/18487 · Exploit
• 🔥 http://exploit-db.com/exploits/18487 · Exploit
• 🔥 http://exploit-db.com/exploits/17193 · Exploit
• 🔥 https://exploit-db.com/exploits/17193 · Exploit
• http://secunia.com/advisories/44313 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-1416 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66985 · Note
• http://osvdb.org/71930 · Note