PT-2018-13280 · E107 · E107

Dhananjay Bajaj · Published 2018-08-28 · Updated 2018-11-02 · CVE-2018-15901

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions e107 version 2.1.8

Description The issue allows for Cross-Site Request Forgery (CSRF) attacks in the 'usersettings.php' file, enabling an attacker to change user details, including passwords, for all users, including administrators.

Recommendations For e107 version 2.1.8, consider implementing CSRF protection mechanisms, such as tokens, to prevent unauthorized changes to user settings, including passwords, until a patch is available. As a temporary workaround, restrict access to the 'usersettings.php' file to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2018-15901

Affected Products

E107

References · 5

• 🔥 https://github.com/dhananjay-bajaj/e107_2.1.8_csrf/blob/master/E107_v2.1.8_CSRF_POC.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-15901 · Security Note
• https://osv.dev/vulnerability/CVE-2018-15901 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15901 · Note
• https://github.com/dhananjay-bajaj/e107_2.1.8_csrf · Note