medium6.8Public exploit code
CVE-2014-10001
Multiple cross-site request forgery (CSRF) vulnerabilities in PHPJabbers Appointment Scheduler 2.0 allow remote attackers to hijack the authentication of admin…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- PHPJabbers Appointment Scheduler 2.0 - Multiple Vulnerabilities2014-01-14 · webapps · php
Impact
Multiple cross-site request forgery (CSRF) vulnerabilities in PHPJabbers Appointment Scheduler 2.0 allow remote attackers to hijack the authentication of administrators for requests that (1) conduct cross-site scripting (XSS) attacks via the i18n[1][name] parameter in a pjActionCreate action to the pjAdminServices controller or (2) add an administrator via a pjActionCreate action to the pjAdminUsers controller.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Phpjabbers | Appointment Scheduler | Version 2.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/124755
- http://secunia.com/advisories/56377
- http://www.exploit-db.com/exploits/30911
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90419
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90420
- http://packetstormsecurity.com/files/124755
- http://secunia.com/advisories/56377
- http://www.exploit-db.com/exploits/30911
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90419
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90420