CVE-2012-4252 Multiple cross-site request forgery (CSRF) vulnerabilities in MySQLDumper 1.24.4 allow remote attackers to hijack the authentication of administrators for requests that (1) remove file access restrict...
MediumCVSS 5.1
EPSS 1.1%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in MySQLDumper 1.24.4 allow remote attackers to hijack the authentication of administrators for requests that (1) remove file access restriction via a deletehtaccess action, (2) drop a database via a kill value in a db action, (3) uninstall the application via a 101 value in the phase parameter to learn/cubemail/install.php, (4) delete config.php via a 2 value in the phase parameter to learn/cubemail/install.php, (5) change a password via a schutz action, or (6) execute arbitrary SQL commands via the sql_statement parameter to learn/cubemail/sql.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mysqldumper | = 1.24.4 | No fix listed |
References
- packetstormsecurity.org exploit
- 81613 vdb-entry
- 53306 exploit vdb-entry
- mysqldumper-main-csrf(75285) vdb-entry