PT-2018-17955 · Bravo Tejari · Bravo Tejari Procurement Portal

Arvind Vishwakarma + 1 · Published 2018-02-18 · Updated 2018-03-16 · CVE-2018-7216

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bravo Tejari Procurement Portal (affected versions not specified)

Description A cross-site request forgery (CSRF) issue exists due to the lack of anti-CSRF tokens, allowing remote authenticated users to hijack the authentication of application users for requests that modify their personal data. This can be achieved by leveraging the esop/toolkit/profile/regData.do endpoint.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2018-7216

Affected Products

Bravo Tejari Procurement Portal

References · 5

• 🔥 https://exploit-db.com/exploits/44256 · Exploit
• 🔥 https://packetstormsecurity.com/files/146409/Tejari-Cross-Site-Request-Forgery.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2018/Feb/44 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-7216 · Security Note
• https://securityfocus.com/archive/1/541782/30/0/threaded · Note