PT-2014-2878 · Xibo · Digital Signage Xibo

Published 2014-01-29 · Updated 2025-12-08 · CVE-2013-4889

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Digital Signage Xibo version 1.4.2

Description The issue allows remote attackers to hijack the authentication of administrators for requests, including adding a new administrator via the AddUser action or conducting cross-site scripting (XSS) attacks.

Recommendations For Digital Signage Xibo version 1.4.2, consider disabling the AddUser action in index.php as a temporary workaround until a patch is available. Restrict access to index.php to minimize the risk of exploitation. Avoid using the affected functionality in index.php until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2013-4889

Affected Products

Digital Signage Xibo

References · 4

• 🔥 https://exploit-db.com/exploits/38746 · Exploit
• 🔥 http://infosec42.blogspot.com/2013/08/exploit-xibo-digital-signage-sql.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-4889 · Security Note
• https://t.me/cveNotify/145119 · Telegram Post