e107 '/e107_admin/newspost.php' Cross Site Request Forgery Vulnerability

Bugtraq ID:	57092
Class:	Design Error
CVE:	CVE-2012-6433
Remote:	Yes
Local:	No
Published:	Jan 02 2013 12:00AM
Updated:	Jan 02 2013 12:00AM
Credit:	Joshua Reynolds
Vulnerable:	e107 e107 1.0.1
Not Vulnerable:

e107 '/e107_admin/newspost.php' Cross Site Request Forgery Vulnerability

e107 is prone to a cross-site request-forgery vulnerability because the application fails to properly validate HTTP requests.

Exploiting this issue may allow a remote attacker to perform certain actions in the context of an authorized user's session and gain unauthorized access to the affected application; other attacks are also possible.

e107 1.0.1 is vulnerable; other versions may also be affected.

e107 '/e107_admin/newspost.php' Cross Site Request Forgery Vulnerability

An attacker can exploit HTML-injection issues through a browser. To exploit the cross-site request-forgery issue, an attacker must entice an unsuspecting user into visiting a malicious site.

The following example data is available:

• /data/vulnerabilities/exploits/57092.html.txt

e107 '/e107_admin/newspost.php' Cross Site Request Forgery Vulnerability

Solution:
Updates are available; please see the references for more information.

e107 '/e107_admin/newspost.php' Cross Site Request Forgery Vulnerability

References:

• e107 CMS Homepage (e107)