PT-2014-3385 · B2Evolution · B2Evolution

Published 2014-04-02 · Updated 2014-04-03 · CVE-2013-7352

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions b2evolution versions prior to 4.1.7

Description A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the show statuses[] parameter.

Recommendations For versions prior to 4.1.7, update to version 4.1.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the blogs/admin.php endpoint to minimize the risk of exploitation. Avoid using the show statuses[] parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2013-7352

Affected Products

B2Evolution

References · 7

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2013-05/0004.html · Exploit
• 🔥 http://packetstormsecurity.com/files/121481/b2evolution-4.1.6-SQL-Injection.html · Exploit
• 🔥 https://htbridge.com/advisory/HTB23152 · Exploit
• http://b2evolution.net/news/2013/04/29/b2evolution-4-1-7-and-5-0-3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-7352 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7352 · Note
• http://osvdb.org/show/osvdb/92906 · Note