CVE-2014-4718 Multiple cross-site request forgery (CSRF) vulnerabilities in Lunar CMS before 3.3-3 allow remote attackers to hijack the authentication of administrators for requests that (1) add Super users via a r...
MediumCVSS 6.8
EPSS 2.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in Lunar CMS before 3.3-3 allow remote attackers to hijack the authentication of administrators for requests that (1) add Super users via a request to admin/user_create.php or conduct cross-site scripting (XSS) attacks via the (2) email or (3) subject parameter in contact_form.ext.php to admin/extensions.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lunarcms lunar cms | <= 3.3 | No fix listed |
| lunarcms lunar cms | = 3.1 | No fix listed |
| lunarcms lunar cms | = 3.2 | No fix listed |
| lunarcms lunar cms | = 3.3 | No fix listed |
References
- lunarcms.com patch
- 108350 vdb-entry
- 108351 vdb-entry
- packetstormsecurity.com exploit
- 59411 third-party-advisory
- 33830 exploit
- 68153 vdb-entry
- www.zeroscience.mk