vendor:
jRank Topsites Script
by:
Ihsan Sencan
7,8
CVSS
HIGH
Cross-Site Request Forgery
352
CWE
Product Name: jRank Topsites Script
Affected Version From: 1.0
Affected Version To: 1.0
Patch Exists: NO
Related CWE: N/A
CPE: a:topsitesscript:jrank_topsites_script
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: WiN7_x64/KaLiLinuX_x64
2017
jRank – Topsites Script 1.0 – Cross-Site Request Forgery
jRank Topsites Script version 1.0 is vulnerable to Cross-Site Request Forgery (CSRF). An attacker can exploit this vulnerability to perform administrative actions on behalf of the administrator. This can be done by tricking the administrator into clicking a malicious link or visiting a malicious website. The malicious website can contain a crafted HTML form with hidden parameters that will be automatically submitted to the vulnerable application. This can be used to perform administrative actions such as creating a new user, changing the administrator's password, etc.
Mitigation:
The application should implement a CSRF protection mechanism to prevent attackers from exploiting this vulnerability. This can be done by implementing a unique token in the HTML form that is generated for each user session.
