medium6.8Public exploit code
CVE-2012-6433
Cross-site request forgery (CSRF) vulnerability in e107_admin/newspost.php in e107 1.0.1 allows remote attackers to hijack the authentication of administrators…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- e107 1.0.1 - Arbitrary JavaScript Execution (via Cross-Site Request Forgery)2013-01-02 · webapps · php · Verified
Impact
Cross-site request forgery (CSRF) vulnerability in e107_admin/newspost.php in e107 1.0.1 allows remote attackers to hijack the authentication of administrators for requests that conduct XSS attacks via the news_title parameter in a create action.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| E107 | E107 | Version 1.0.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://e107.org/changelog
- http://e107.svn.sourceforge.net/viewvc/e107/trunk/e107_0.7/e107_admin/newspost.php?sortdir=down&r1=12622&r2=12992&sortby=rev
- http://www.exploit-db.com/exploits/23828/
- http://e107.org/changelog
- http://e107.svn.sourceforge.net/viewvc/e107/trunk/e107_0.7/e107_admin/newspost.php?sortdir=down&r1=12622&r2=12992&sortby=rev
- http://www.exploit-db.com/exploits/23828/