PT-2014-8946 · Snowfox · Snowfox Cms

Published 2014-12-08 · Updated 2017-09-08 · CVE-2014-9343

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Snowfox CMS version 1.0

Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This is achieved via a URL in the rd parameter in a submit action to "snowfox/".

Recommendations For Snowfox CMS version 1.0, consider restricting access to the selectlanguage.class.php module until a patch is available. As a temporary workaround, avoid using the rd parameter in the affected submit action to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2014-9343

Affected Products

Snowfox Cms

References · 7

• 🔥 http://zeroscience.mk/en/vulnerabilities/ZSL-2014-5206.php · Exploit
• 🔥❌ https://github.com/GlobizSolutions/snowfox/commit/55a8e44a9d9a9a788cc1cde6baf0c2c67e0c736a · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2014-9343 · Security Note
• ❌ https://github.com/GlobizSolutions/snowfox/releases · Note, Deleted
• http://osvdb.org/show/osvdb/114850 · Note
• http://packetstormsecurity.com/files/129162/Snowfox-CMS-1.0-Open-Redirect.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/99128 · Note