medium6.8Public exploit code
CVE-2012-1978
Multiple cross-site request forgery (CSRF) vulnerabilities in Simple PHP Agenda 2.2.8 and earlier allow remote attackers to hijack the authentication of admini…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Simple PHP Agenda 2.2.8 - Cross-Site Request Forgery (Add Admin / Add Event)2012-04-03 · webapps · php · Verified
Impact
Multiple cross-site request forgery (CSRF) vulnerabilities in Simple PHP Agenda 2.2.8 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add an administrator via a request to auth/process.php, (2) delete an administrator via a request to auth/admin/adminprocess.php, (3) add an event via a request to engine/new_event.php, or (4) delete an event via a request to phpagenda/.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Simple Php Agenda Project | Simple Php Agenda | through 2.2.8 |
Weakness classification
References
- NVD record
- CVE.org record
- http://osvdb.org/80793
- http://packetstormsecurity.com/files/111408/Simple-PHP-Agenda-2.2.8-Cross-Site-Request-Forgery.html
- http://www.securityfocus.com/bid/74778
- http://www.webapp-security.com/2012/03/simple-php-agenda/
- http://www.webapp-security.com/wp-content/uploads/2012/03/Simple-PHP-Agenda-2.2.8-Multiple-CSRF-Add-Admin-Add-Event4.txt
- http://osvdb.org/80793
- http://packetstormsecurity.com/files/111408/Simple-PHP-Agenda-2.2.8-Cross-Site-Request-Forgery.html
- http://www.securityfocus.com/bid/74778
- http://www.webapp-security.com/2012/03/simple-php-agenda/
- http://www.webapp-security.com/wp-content/uploads/2012/03/Simple-PHP-Agenda-2.2.8-Multiple-CSRF-Add-Admin-Add-Event4.txt