PT-2022-26848 · Eyoucms · Eyoucms

H18192Ho · Published 2022-11-14 · Updated 2025-04-30 · CVE-2022-43323

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EyouCMS version 1.5.9-UTF8-SP1

Description A Cross-Site Request Forgery (CSRF) issue was discovered in the Top Up Balance component under the Edit Member module. This allows for malicious requests to be made without the user's knowledge or consent.

Recommendations For EyouCMS version 1.5.9-UTF8-SP1, as a temporary workaround, consider disabling the Top Up Balance component under the Edit Member module until a patch is available. Restrict access to the Edit Member module to minimize the risk of exploitation. Avoid using the Top Up Balance feature in the affected module until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-43323

Affected Products

Eyoucms

References · 6

• 🔥 https://github.com/weng-xianhu/eyoucms/issues/28#issue-1410026516 · Exploit
• https://osv.dev/vulnerability/CVE-2022-43323 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43323 · Security Note
• https://t.me/cvenotify/37914 · Telegram Post
• https://t.me/cvenotify/37669 · Telegram Post
• https://t.me/cvenotify/120344 · Telegram Post