Mambo CMS 'index.php' Cross-Site Request Forgery Vulnerability
BID:49315
Info
Mambo CMS 'index.php' Cross-Site Request Forgery Vulnerability
| Bugtraq ID: | 49315 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 26 2011 12:00AM |
| Updated: | Mar 19 2015 09:41AM |
| Credit: | Caddy-Dz |
| Vulnerable: |
Mambo Mambo Open Source 4.6.5 |
| Not Vulnerable: | |
Discussion
Mambo CMS 'index.php' Cross-Site Request Forgery Vulnerability
Mambo CMS is prone to a cross-site request-forgery vulnerability.
Attackers can exploit this issue by tricking an unsuspecting user into visiting a malicious Web page. The page will consist of specially crafted script code designed to perform some action on the attacker's behalf.
Successful exploits will allow attackers to run privileged commands on the affected device.
Mambo CMS 4.6.5 is vulnerable; other versions may also be affected.
Mambo CMS is prone to a cross-site request-forgery vulnerability.
Attackers can exploit this issue by tricking an unsuspecting user into visiting a malicious Web page. The page will consist of specially crafted script code designed to perform some action on the attacker's behalf.
Successful exploits will allow attackers to run privileged commands on the affected device.
Mambo CMS 4.6.5 is vulnerable; other versions may also be affected.
Exploit / POC
Mambo CMS 'index.php' Cross-Site Request Forgery Vulnerability
To exploit this issue, an attacker must entice an unsuspecting victim to follow a malicious URI.
The following exploit is available:
To exploit this issue, an attacker must entice an unsuspecting victim to follow a malicious URI.
The following exploit is available:
Solution / Fix
Mambo CMS 'index.php' Cross-Site Request Forgery Vulnerability
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].