vendor:
RBS Change Complet Open Source
by:
KrustyHack
8,8
CVSS
HIGH
Cross-Site Request Forgery (CSRF)
352
CWE
Product Name: RBS Change Complet Open Source
Affected Version From: 3.6.8
Affected Version To: 3.6.8
Patch Exists: YES
Related CWE: N/A
CPE: a:rbs_change:rbs_change_complet_open_source
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Chrome, Firefox
2014
RBS Change Complet Open Source multiple CSRF vulnerabilities POST and GET
Multiple CSRF vulnerabilities into RBS CHange Complet Open Source CMS which allow an attacker to tricks a regular logged in user by executing basket related commands like adding a product to the basket, setting a new shipping address, setting delivery mode, confirm basket and in some case confirm payment (tested with payment by check).
Mitigation:
Implementing CSRF protection tokens, using same-site cookies, and using HTTPOnly cookies can help mitigate CSRF attacks.
