medium6.8Public exploit code
CVE-2014-9344
Cross-site request forgery (CSRF) vulnerability in Snowfox CMS before 1.0.10 allows remote attackers to hijack the authentication of administrators for request…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Snowfox CMS 1.0 - Cross-Site Request Forgery (Add Admin)2014-11-19 · webapps · php
Impact
Cross-site request forgery (CSRF) vulnerability in Snowfox CMS before 1.0.10 allows remote attackers to hijack the authentication of administrators for requests that add a new admin account via a submit action in the admin/accounts/create uri to snowfox/.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Globiz Solutions | Snowfox Content Management System | through 1.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://osvdb.org/show/osvdb/114819
- http://packetstormsecurity.com/files/129164/Snowfox-CMS-1.0-Cross-Site-Request-Forgery.html
- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5205.php
- https://exchange.xforce.ibmcloud.com/vulnerabilities/99128
- https://github.com/GlobizSolutions/snowfox/releases
- http://osvdb.org/show/osvdb/114819
- http://packetstormsecurity.com/files/129164/Snowfox-CMS-1.0-Cross-Site-Request-Forgery.html
- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5205.php
- https://exchange.xforce.ibmcloud.com/vulnerabilities/99128
- https://github.com/GlobizSolutions/snowfox/releases