CVE-2015-3141
Multiple cross-site request forgery (CSRF) vulnerabilities in Synametrics Technologies Xeams 4.5 Build 5755 and earlier allow remote attackers to hijack the au…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Xeams 4.5 Build 5755 - Multiple Vulnerabilities2015-05-08 · webapps · php
Impact
Multiple cross-site request forgery (CSRF) vulnerabilities in Synametrics Technologies Xeams 4.5 Build 5755 and earlier allow remote attackers to hijack the authentication of administrators for requests that create an (1) SMTP domain or a (2) user via a request to /FrontController; or conduct cross-site scripting (XSS) attacks via the (3) domainname parameter to /FrontController, when creating a new SMTP domain configuration; the (4) txtRecipient parameter to /FrontController, when creating a new forwarder; the (5) popFetchServer, (6) popFetchUser, or (7) popFetchRecipient parameter to /FrontController, when creating a new POP3 Fetcher account; or the (8) Smtp HELO domain in the Advanced Server Configuration.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Synametrics | Xeams | through 4.5 |
Weakness classification
References
- NVD record
- CVE.org record
- http://osvdb.org/show/osvdb/121847
- http://packetstormsecurity.com/files/131844/Xeams-4.5-Build-5755-CSRF-Cross-Site-Scripting.html
- http://www.securityfocus.com/bid/74578
- https://www.exploit-db.com/exploits/36949/
- http://osvdb.org/show/osvdb/121847
- http://packetstormsecurity.com/files/131844/Xeams-4.5-Build-5755-CSRF-Cross-Site-Scripting.html
- http://www.securityfocus.com/bid/74578
- https://www.exploit-db.com/exploits/36949/