Hashtopus CVE-2017-11679 Cross Site Request Forgery Vulnerability

Bugtraq ID:	99984
Class:	Design Error
CVE:	CVE-2017-11679
Remote:	Yes
Local:	No
Published:	Jul 27 2017 12:00AM
Updated:	Jul 27 2017 12:00AM
Credit:	havoc88
Vulnerable:	cURLybOi Hashtopus 1.5g
Not Vulnerable:

Hashtopus CVE-2017-11679 Cross Site Request Forgery Vulnerability

Hashtopus is prone to a cross-site request-forgery vulnerability because it fails to properly validate requests.

Exploiting this issue allows a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible.

Hashtopus 1.5g is vulnerable; other versions may also be affected.

Hashtopus CVE-2017-11679 Cross Site Request Forgery Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

Hashtopus CVE-2017-11679 Cross Site Request Forgery Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Hashtopus CVE-2017-11679 Cross Site Request Forgery Vulnerability

References:

• Hashtopus 1.5 Multiple Vulnerabilities #63 (curlyboi)
  
• Hashtopus Home Page (curlyboi)