Open-Realty Cross Site Request Forgery Vulnerability

Bugtraq ID:	56580
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 16 2012 12:00AM
Updated:	Nov 16 2012 12:00AM
Credit:	Aung Khant
Vulnerable:	Transparent Technologies Open Realty 2.5.8
Not Vulnerable:

Open-Realty Cross Site Request Forgery Vulnerability

Open-Realty is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain unauthorized administrative actions and gain access to the affected application. Other attacks are also possible.

Open-Realty 2.5.8 and prior versions are vulnerable; other versions may also be affected.

Open-Realty Cross Site Request Forgery Vulnerability

To exploit this issue, an attacker must entice an unsuspecting victim to open a malicious URI.

The following exploit is available:

• /data/vulnerabilities/exploits/56580.html.txt

Open-Realty Cross Site Request Forgery Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of any more recent information, please mail us at: [email protected].

Open-Realty Cross Site Request Forgery Vulnerability

References:

• Open-Realty CMS 2.5.8 (2.x.x) <= Cross Site Request Forgery (CSRF) Vulnerabilit (Aung Khant)
  
• Open-Realty Homepage (Open-Realty)
  
• [email protected]: Open-Realty CMS 2.5.8 (2.x.x) <= Cross Site Request Forgery (CSR (Transparent Technologies)