PT-2015-3511 · Whcms · Whcms
Published
2015-01-01
·
Updated
2015-01-02
·
CVE-2011-5315
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
whCMS version 0.115 alpha
Description
A cross-site request forgery issue exists, allowing remote attackers to hijack administrator authentication for requests that modify credentials via a user save action.
Recommendations
For whCMS version 0.115 alpha, consider disabling the user save action in admin/index.php until a patch is available to prevent exploitation. Restrict access to the admin/index.php module to minimize the risk of hijacking administrator authentication.
Exploit
Fix
CSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Whcms