PT-2024-38123 · Seacms · Seacms

Jiashenghe · Published 2024-07-28 · Updated 2024-09-19 · CVE-2024-7161

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions SeaCMS version 13.0

Description A problematic issue was found in the Password Change Handler component, specifically in the /member.php?action=chgpwdsubmit file. The manipulation of the newpwd and newpwd2 arguments leads to cross-site request forgery. This issue can be exploited remotely.

Recommendations For SeaCMS version 13.0, consider disabling the password change functionality in the /member.php?action=chgpwdsubmit file until a patch is available. Restrict access to this file to minimize the risk of exploitation. Avoid using the newpwd and newpwd2 arguments in the affected API endpoint until the issue is resolved.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-7161

Affected Products

Seacms

References · 9

• 🔥 https://github.com/HuaQiPro/seacms/issues/30 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-7161 · Security Note
• https://osv.dev/vulnerability/CVE-2024-7161 · Vendor Advisory
• https://vuldb.com/?ctiid.272575 · Note
• https://t.me/cvenotify/95254 · Telegram Post
• https://t.me/cvedetector/1777 · Telegram Post
• https://vuldb.com/?id.272575 · Note
• https://vuldb.com/?submit.379473 · Note
• https://t.me/cvenotify/87673 · Telegram Post