vendor:
FrogCMS
by:
Samrat Das
8.8
CVSS
HIGH
Cross Site Request Forgery
352
CWE
Product Name: FrogCMS
Affected Version From: 0.9.5
Affected Version To: 0.9.5
Patch Exists: YES
Related CWE: CVE-2018-8908
CPE: a:frogcms:frog_cms
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: Webapp CMS
2018
Cross Site Request Forgery- Frog CMS
The application source code is coded in a way which allows malicious HTML request to be executed without veryifying source of request.This leads to arbitary execution with malicous request which will lead to the creation of a privileged user.
Mitigation:
The application code should be configured to implement anti csrf token to filter malicous HTTP Requests.
