CVE-2013-3729 Multiple cross-site request forgery (CSRF) vulnerabilities in Kasseler CMS before 2 r1232 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection....
MediumCVSS 6.8
EPSS 1.2%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in Kasseler CMS before 2 r1232 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the (1) groups[] parameter in a send action in the sendmail module or (2) query parameter in a sql_query action in the database module to admin.php, related to CVE-2013-3727.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kasseler-cms | <= 2 | No fix listed |
References
- diff.kasseler-cms.net
- diff.kasseler-cms.net patch vendor-advisory
- 94781 vdb-entry
- packetstormsecurity.com exploit
- 20130703 Multiple Vulnerabilities in Kasseler CMS exploit mailing-list
- www.htbridge.com exploit