vendor:
RV Article publisher
by:
DaOne
8,8
CVSS
HIGH
Cross-Site Request Forgery (CSRF)
352
CWE
Product Name: RV Article publisher
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2012
RV Article publisher CSRF Vulnerability
This exploit allows an attacker to add an admin user to the RV Article publisher application. The attacker can craft a malicious HTML page that contains a form with hidden fields that contain the username, email, password, group, active, superadmin, postnote, and save_user values. When the victim visits the malicious page, the form is automatically submitted and the admin user is added to the application.
Mitigation:
The application should implement CSRF protection tokens to verify that the request is coming from a trusted source.
