PT-2018-11504
CVE-2018-12971
·
Published
2018-06-29
·
Updated
2018-08-20
Description by
CVSS 3.1
6.5
MediumMetricsAV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions
EasyCMS version 1.3
Description
The issue allows for CSRF via the "index.php?s=/admin/user/delAll" URI to delete users.
Recommendations
For EasyCMS version 1.3, consider implementing proper CSRF protection mechanisms, such as token-based validation, to prevent unauthorized actions like deleting users. As a temporary workaround, restrict access to the "index.php?s=/admin/user/delAll" URI to minimize the risk of exploitation.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾