WordPress Sahifa Theme Multiple Cross Site Request Forgery Vulnerabilities

Bugtraq ID:	57109
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 01 2013 12:00AM
Updated:	Jan 01 2013 12:00AM
Credit:	Akastep
Vulnerable:	WordPress Sahifa 2.4
Not Vulnerable:

WordPress Sahifa Theme Multiple Cross Site Request Forgery Vulnerabilities

The Sahifa theme for WordPress is prone to multiple cross-site request-forgery vulnerabilities because the application fails to properly validate HTTP requests.

Exploiting these issues may allow a remote attacker to perform certain actions in the context of an authorized user's session and gain unauthorized access to the affected application; other attacks are also possible.

Sahifa 2.4.0 is vulnerable; other versions may also be affected.

WordPress Sahifa Theme Multiple Cross Site Request Forgery Vulnerabilities

An attacker can exploit these issues by enticing an unsuspecting user to follow a malicious URI.

The following exploit is available:

• /data/vulnerabilities/exploits/57109.html.txt

WordPress Sahifa Theme Multiple Cross Site Request Forgery Vulnerabilities

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of any more recent information, please mail us at: [email protected].

WordPress Sahifa Theme Multiple Cross Site Request Forgery Vulnerabilities

References:

• Sahifa Download page (Themeforest)
  
• WordPress Homepage (WordPress)