CVE-2011-0535 Cross-site request forgery (CSRF) vulnerability in the Users module in Zikula before 1.2.5 allows remote attackers to hijack the authentication of administrators for requests that change account privi...
MediumCVSS 6.8
EPSS 1.4%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site request forgery (CSRF) vulnerability in the Users module in Zikula before 1.2.5 allows remote attackers to hijack the authentication of administrators for requests that change account privileges via an edit access_permissions action to index.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zikula application framework | <= 1.2.4 | No fix listed |
| zikula application framework | = 1.1.2 | No fix listed |
| zikula application framework | = 1.2.1 | No fix listed |
| zikula application framework | = 1.2.2 | No fix listed |
| zikula application framework | = 1.2.3 | No fix listed |
References
- bl0g.yehg.net exploit
- code.zikula.org
- community.zikula.org
- [oss-security] 20110201 CVE Request: Zikula CMS 1.2.4 <= Cross Site Request Forgery (CSRF) Vulnerability exploit mailing-list
- [oss-security] 20110203 Re: CVE Request: Zikula CMS 1.2.4 <= Cross Site Request Forgery (CSRF) Vulnerability exploit mailing-list
- 20110201 Zikula CMS 1.2.4 <= Cross Site Request Forgery (CSRF) Vulnerability exploit mailing-list
- 43114 third-party-advisory vendor-advisory
- 8067 third-party-advisory
- 70751 vdb-entry