PT-2018-13574 · Frog Cms · Frog Cms

Furykangaroo · Published 2018-09-04 · Updated 2019-02-25 · CVE-2018-16447

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Frog CMS version 0.9.5

Description The issue concerns a CSRF vulnerability in the admin interface, specifically affecting the "user/edit/1" endpoint. This could potentially allow unauthorized actions to be performed on user accounts.

Recommendations For Frog CMS version 0.9.5, consider implementing proper CSRF token validation to prevent unauthorized requests to the "admin/?/user/edit/1" endpoint. As a temporary workaround, restrict access to this endpoint until a proper fix is applied.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2018-16447

Affected Products

Frog Cms

References · 4

• 🔥 https://github.com/philippe/FrogCMS/issues/12 · Exploit
• 🔥❌ https://github.com/security-breachlock/CVE-2018-16447/blob/master/frog_CSRF.pdf · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2018-16447 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-16447 · Security Note