HMS Testimonials Multiple Cross Site Request Forgery Vulnerabilities

Bugtraq ID:	61712
Class:	Input Validation Error
CVE:	CVE-2013-4240
Remote:	Yes
Local:	No
Published:	Aug 08 2013 12:00AM
Updated:	Mar 19 2015 08:18AM
Credit:	Adéla Goldová
Vulnerable:	Jeff Kreitner Hms-Testimonials 2.0.10 Jeff Kreitner Hms-Testimonials 2.0.9
Not Vulnerable:	Jeff Kreitner Hms-Testimonials 2.0.11

HMS Testimonials Multiple Cross Site Request Forgery Vulnerabilities

The HMS Testimonials plugin for WordPress is prone to multiple cross-site request-forgery vulnerabilities.

Exploiting these issues may allow a remote attacker to perform certain unauthorized actions in the context of the affected application. Other attacks are also possible.

HMS Testimonials 2.0.10 is vulnerable; other versions may also be affected.

HMS Testimonials Multiple Cross Site Request Forgery Vulnerabilities

An attacker can exploit these issues by enticing an unsuspecting user to follow a malicious URI.

The following example data is available:

• /data/vulnerabilities/exploits/61712.txt

HMS Testimonials Multiple Cross Site Request Forgery Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

HMS Testimonials Multiple Cross Site Request Forgery Vulnerabilities

References:

• [Full-disclosure] [RCA-201308-01] HMS Testimonials 2.0.10 WP plugin - Multiple v (Adéla Goldová)
  
• HMS Testimonials Homepage (WordPress)