CVE-2013-7352

Name of the Vulnerable Software and Affected Versions b2evolution versions prior to 4.1.7

Description A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the show statuses[] parameter.

Recommendations For versions prior to 4.1.7, update to version 4.1.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the blogs/admin.php endpoint to minimize the risk of exploitation. Avoid using the show statuses[] parameter in the affected endpoint until the issue is resolved.