PT-2015-6596 · B.A.S · B.A.S C2Box

Wissam Bashour · Published 2015-07-16 · Updated 2016-12-07 · CVE-2015-4460

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions B.A.S C2Box versions prior to 4.0.0 (r19171)

Description A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of administrators for requests that add administrator accounts via certain vectors.

Recommendations For versions prior to 4.0.0 (r19171), update to version 4.0.0 (r19171) or later to resolve the issue.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2015-4460

Affected Products

B.A.S C2Box

References · 6

• 🔥 https://exploit-db.com/exploits/37447 · Exploit
• 🔥 http://securityfocus.com/archive/1/535861/30/0/threaded · Exploit
• 🔥 https://packetstormsecurity.com/files/132475/C2Box-4.0.0-r19171-Cross-Site-Request-Forgery.html · Exploit
• 🔥 https://raw.githubusercontent.com/Siros96/CSRF/master/PoC · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-4460 · Security Note
• http://securityfocus.com/bid/75569 · Note