PT-2019-7251 · 6Kbbs · 6Kbbs

Wang Jing · Published 2019-08-08 · Updated 2019-08-15 · CVE-2015-9292

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions 6kbbs versions 7.1 through 8.0

Description The issue allows for CSRF attacks via specific API endpoints, including "portalchannel ajax.php" with id or code parameters, and "admin.php" with a fileids parameter.

Recommendations For versions 7.1 and 8.0, consider restricting access to the "portalchannel ajax.php" and "admin.php" endpoints to minimize the risk of exploitation. As a temporary workaround, avoid using the id, code, and fileids parameters in the affected API endpoints until the issue is resolved.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2015-9292

Affected Products

6Kbbs

References · 5

• 🔥 https://cxsecurity.com/issue/WLB-2015040034 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-9292 · Security Note
• https://t.me/cibsecurity/6165 · Telegram Post
• https://t.me/cibsecurity/6016 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9292 · Note