CVE-2015-2680

EPSS 3.9%

Cross-site request forgery (CSRF) vulnerability in MetalGenix GeniXCMS before 0.0.2 allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via a request in the users page to gxadmin/index.php.

Affected products

n/a · n/a

public PoCs found — 3

cve_referencepacketstormsecurity.com/files/130772/GeniXCMS-0.0.1-Cross-Site-Request-Forgery.htmlunverified cve_referencewww.exploit-db.com/exploits/36321unverified exploitdbwww.exploit-db.com/exploits/36321unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://blog.metalgenix.com/genixcms-v0-0-2-release-security-and-bug-fixes/17 http://blog.metalgenix.com/update-security-fix-and-add-newsletter-module/16 http://osvdb.org/show/osvdb/119391 http://packetstormsecurity.com/files/130772/GeniXCMS-0.0.1-Cross-Site-Request-Forgery.html https://github.com/semplon/GeniXCMS/commit/698245488343396185b1b49e7482ee5b25541815 https://github.com/semplon/GeniXCMS/issues/7 http://www.exploit-db.com/exploits/36321 http://www.securityfocus.com/bid/73299 http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5234.php