PT-2015-3521 · Php · Simple Php Agenda

Published 2015-05-21 · Updated 2015-07-27 · CVE-2012-1978

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Simple PHP Agenda versions 2.2.8 and earlier

Description The issue allows remote attackers to hijack the authentication of administrators for various requests. This can be achieved through requests to several API endpoints, including "auth/process.php" to add an administrator, "auth/admin/adminprocess.php" to delete an administrator, "engine/new event.php" to add an event, or "phpagenda/" to delete an event.

Recommendations For Simple PHP Agenda versions 2.2.8 and earlier, consider implementing proper CSRF protection mechanisms, such as tokens, to prevent unauthorized requests. As a temporary workaround, restrict access to the "auth/process.php", "auth/admin/adminprocess.php", "engine/new event.php", and "phpagenda/" endpoints to minimize the risk of exploitation. Avoid performing sensitive actions, such as adding or deleting administrators and events, from untrusted sources until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2012-1978

Affected Products

Simple Php Agenda

References · 7

• 🔥 http://webapp-security.com/2012/03/simple-php-agenda · Exploit
• 🔥 http://packetstormsecurity.com/files/111408/Simple-PHP-Agenda-2.2.8-Cross-Site-Request-Forgery.html · Exploit
• 🔥 https://exploit-db.com/exploits/18694 · Exploit
• 🔥 http://webapp-security.com/wp-content/uploads/2012/03/Simple-PHP-Agenda-2.2.8-Multiple-CSRF-Add-Admin-Add-Event4.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-1978 · Security Note
• http://securityfocus.com/bid/74778 · Note
• http://osvdb.org/80793 · Note