PT-2021-17734 · Popojicms · Popojicms

Fatmo666 · Published 2021-08-25 · Updated 2021-08-30 · CVE-2021-28070

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: PopojiCMS version 2.0.1

Description: A Cross Site Request Forgery (CSRF) issue exists, which can be exploited through the /po-admin/route.php?mod=user&act=multidelete API endpoint. This allows for potentially unauthorized actions on user accounts.

Recommendations: For PopojiCMS version 2.0.1, consider implementing proper CSRF token validation to prevent unauthorized requests to the /po-admin/route.php?mod=user&act=multidelete endpoint. As a temporary workaround, restrict access to this endpoint until a proper fix is applied.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-28070

Affected Products

Popojicms

References · 3

• 🔥 https://github.com/PopojiCMS/PopojiCMS/issues/31 · Exploit
• https://osv.dev/vulnerability/CVE-2021-28070 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28070 · Security Note