CXSecurity WLB-2015040034 6kbbs v8.0 Multiple CSRF (Cross-Site Request Forgery) Web Security Vulnerabilities
Exploit Title: 6kbbs Multiple CSRF (Cross-Site Request Forgery) Security Vulnerabilities
Vendor: 6kbbs
Product: 6kbbs
Vulnerable Versions: v7.1 v8.0
Tested Version: v7.1 v8.0
Advisory Publication: April 02, 2015
Latest Update: April 02, 2015
Vulnerability Type: Cross-Site Request Forgery (CSRF) [CWE-352]
CVE Reference: *
CXSecurity Reference: WLB-2015040034
Impact CVSS Severity (version 2.0):
CVSS v2 Base Score: 6.8 (MEDIUM) (AV:N/AC:M/Au:N/C:P/I:P/A:P) (legend)
Impact Subscore: 6.4
Exploitability Subscore: 8.6
CVSS Version 2 Metrics:
Access Vector: Network exploitable; Victim must voluntarily interact with attack mechanism
Access Complexity: Medium
Authentication: Not required to exploit
Impact Type: Allows unauthorized disclosure of information; Allows unauthorized modification; Allows disruption of service
Writer and Reporter: Jing
Wang, Division of Mathematical Sciences (MAS), School of Physical and
Mathematical Sciences (SPMS), Nanyang Technological University (NTU),
Singapore. (@justqdjing)
Suggestion Details:
(1) Vendor & Product Description:
Vendor:
6kbbs
Product & Vulnerable Versions:
6kbbs
v7.1
v8.0
Vendor URL & download:
6kbbs can be gain from here,
Product Introduction Overview:
"6kbbs
V8.0 is a PHP + MySQL built using high-performance forum, has the code
simple, easy to use, powerful, fast and so on. It is an excellent
community forum program. The program is simple but not simple; fast,
small; Interface generous and good scalability; functional and practical
pursuing superior performance, good interface, the user's preferred
utility functions."
"1,
using XHTML + CSS architecture, so that the structure of the page,
saving transmission static page code, but also easy to modify the
interface, more in line with WEB standards; 2, the Forum adopted
Cookies, Session, Application and other technical data cache on the
forum, reducing access to the database to improve the performance of the
Forum. Can carry more users simultaneously access; 3, the data points
table function, reduce the burden on the amount of data when accessing
the database; 4, support for multi-skin style switching function; 5, the
use of RSS technology to support subscriptions forum posts, recent
posts, user's posts; 6, the display frame mode + tablet mode, the user
can choose according to their own preferences to; 7. forum page
optimization keyword search, so the forum more easily indexed by search
engines; 8, extension, for our friends to provide a forum for a broad
expansion of space services; 9, webmasters can add different top and
bottom of the ad, depending on the layout; 10, post using HTML + UBB way
the two editors, mutual conversion, compatible with each other; ..."
(2) Vulnerability Details:
6kbbs
web application has a computer cyber security bug problem. It can be
exploited by CSRF (Cross-Site Request Forgery) attacks. This may allow
an attacker to trick the victim into clicking on the image to take
advantage of the trust relationship between the authenticated victim and
the application. Such an attack could trick the victim into creating
files that may then be called via a separate CSRF attack or possibly
other means, and executed in the context of their session with the
application, without further prompting or verification.
Several
6kbbs products 0-day vulnerabilities have been found by some other bug
hunter researchers before. 6kbbs has patched some of them. Open Sourced
Vulnerability Database (OSVDB) is an independent and open-sourced
database. The goal of the project is to provide accurate, detailed,
current, and unbiased technical information on security vulnerabilities.
The project promotes greater, open collaboration between companies and
individuals. It has published suggestions, advisories, solutions details
related to csrf vulnerabilities.
(2.1) The
first code programming flaw occurs at "/portalchannel_ajax.php?" page
with "&id" and &code" parameters in HTTP $POST.
(2.2) The second code programming flaw occurs at "/admin.php?" page with "&fileids" parameter in HTTP $POST.
Related Articles:
No comments:
Post a Comment