CVE-2013-7346 Cross-site request forgery (CSRF) vulnerability in Symphony CMS before 2.3.2 allows remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via....
MediumCVSS 6.8
EPSS 0.52%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site request forgery (CSRF) vulnerability in Symphony CMS before 2.3.2 allows remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the sort parameter to system/authors/, related to CVE-2013-2559.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| getsymphony symphony | <= 2.3.1 | No fix listed |
| getsymphony symphony | = 2.0 | No fix listed |
| getsymphony symphony | = 2.0.3 | No fix listed |
| getsymphony symphony | = 2.0.4 | No fix listed |
| getsymphony symphony | = 2.0.5 | No fix listed |
| getsymphony symphony | = 2.0.6 | No fix listed |
| getsymphony symphony | = 2.0.7 | No fix listed |
| getsymphony symphony | = 2.1.0 | No fix listed |
| getsymphony symphony | = 2.1.1 | No fix listed |
| getsymphony symphony | = 2.3 | No fix listed |
References
- 20130403 SQL Injection Vulnerability in Symphony exploit mailing-list
- www.htbridge.com exploit