Cross-Site Request Forgery in PbootCMS by PbootCMS
CVE-2018-10132

8.8HIGH

Key Information:

Vendor

Pbootcms

Status
Pbootcms
Vendor
CVE Published:
16 April 2018

What is CVE-2018-10132?

PbootCMS v0.9.8 is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability that allows an attacker to exploit specific URL requests. By manipulating the admin.php/Message/mod/id/19.html?backurl=/index.php request, attackers can gain the ability to execute arbitrary PHP code through the recontent parameter, posing significant risks to web application integrity and security. Implementing proper CSRF protection measures is crucial to mitigate this vulnerability.

References

https://github.com/vQAQv/Request-CVE-ID-PoC/blob/master/P...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.