CVE-2013-7352 Cross-site request forgery (CSRF) vulnerability in blogs/admin.php in b2evolution before 4.1.7 allows remote attackers to hijack the authentication of administrators for requests that conduct SQL inje...
MediumCVSS 6.8
EPSS 0.61%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site request forgery (CSRF) vulnerability in blogs/admin.php in b2evolution before 4.1.7 allows remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the show_statuses[] parameter, related to CVE-2013-2945.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| b2evolution | <= 4.1.6 | No fix listed |
| b2evolution | = 4.1.0 | No fix listed |
| b2evolution | = 4.1.1 | No fix listed |
| b2evolution | = 4.1.2 | No fix listed |
| b2evolution | = 4.1.3 | No fix listed |
| b2evolution | = 4.1.4 | No fix listed |
| b2evolution | = 4.1.5 | No fix listed |
References
- 20130501 SQL Injection in b2evolution exploit mailing-list
- b2evolution.net patch vendor-advisory
- 92906 vdb-entry
- packetstormsecurity.com exploit
- www.htbridge.com exploit