high8.8Public exploit code
CVE-2017-16244
October CMS CSRF
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- OctoberCMS 1.0.426 (Build 426) - Cross-Site Request Forgery2017-11-01 · webapps · php
Impact
Cross-Site Request Forgery exists in OctoberCMS 1.0.426 (aka Build 426) due to improper validation of CSRF tokens for postback handling, allowing an attacker to successfully take over the victim's account. The attack bypasses a protection mechanism involving X-CSRF headers and CSRF tokens via a certain _handler postback variable.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | october/october | <= 1.0.426 | 1.0.427 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Octobercms | October | Version 1.0.426 |