CVE-2012-6508
Multiple cross-site request forgery (CSRF) vulnerabilities in NetArt Media Car Portal 3.0 allow remote attackers to hijack the authentication of administrators…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Car Portal CMS 3.0 - Multiple Vulnerabilities2012-04-30 · webapps · php
Impact
Multiple cross-site request forgery (CSRF) vulnerabilities in NetArt Media Car Portal 3.0 allow remote attackers to hijack the authentication of administrators for requests that (1) change arbitrary user passwords via a nouveau action in the security module to cars/ADMIN/index.php; (2) create a user or (3) create a sub user via a sub_accounts action in the home module to USERS/index.php; or (4) change profile information via an edit action in the profile module to USERS/index.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Netartmedia | Car Portal | Version 3.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.org/files/112226/Car-Portal-CMS-3.0-CSRF-XSS-Shell-Upload.html
- http://secunia.com/advisories/49010
- http://www.vulnerability-lab.com/get_content.php?id=502
- http://packetstormsecurity.org/files/112226/Car-Portal-CMS-3.0-CSRF-XSS-Shell-Upload.html
- http://secunia.com/advisories/49010
- http://www.vulnerability-lab.com/get_content.php?id=502