e107 'e107_admin/download.php' Cross Site Request Forgery Vulnerability

Bugtraq ID:	57093
Class:	Design Error
CVE:	CVE-2012-6434
Remote:	Yes
Local:	No
Published:	Jan 02 2013 12:00AM
Updated:	Jan 02 2013 12:00AM
Credit:	Joshua Reynolds
Vulnerable:
Not Vulnerable:

e107 'e107_admin/download.php' Cross Site Request Forgery Vulnerability

e107 is prone to a cross-site request-forgery vulnerability because the application fails to properly validate HTTP requests.

Exploiting this issue may allow a remote attacker to perform certain actions in the context of an authorized user's session and gain unauthorized access to the affected application; other attacks are also possible.

e107 1.0.2 is vulnerable; other versions may also be affected.

e107 'e107_admin/download.php' Cross Site Request Forgery Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

The following example data is available:

• /data/vulnerabilities/exploits/57093.txt

e107 'e107_admin/download.php' Cross Site Request Forgery Vulnerability

Solution:
Updates are available. Please see the references for details.

e107 'e107_admin/download.php' Cross Site Request Forgery Vulnerability

References:

• e107 CMS Homepage (e107)