PT-2015-3652 · Stark · Stark Crm

Gjoko Krstic · Published 2015-01-13 · Updated 2017-09-08 · CVE-2014-10008

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Stark CRM version 1.0

Description The issue allows remote attackers to hijack the authentication of administrators for various requests. This can be achieved through crafted requests to specific pages, including the admin page, agent page, sub agent page, partner page, or client page.

Recommendations For Stark CRM version 1.0, consider disabling the affected pages temporarily to minimize the risk of exploitation. Restrict access to these pages until a fix is available. Avoid using the affected functionality in the admin, agent, sub agent, partner, and client pages until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2014-10008

Affected Products

Stark Crm

References · 7

• 🔥 https://exploit-db.com/exploits/31792 · Exploit
• 🔥 http://zeroscience.mk/en/vulnerabilities/ZSL-2014-5169.php · Exploit
• 🔥 http://zeroscience.mk/codes/starkcrm_mv.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-10008 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/91267 · Note
• http://secunia.com/advisories/57048 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/91268 · Note