Vulnerability CVE-2014-1915

Vulnerability CVE-2014-1915

Published: 2014-02-07 Modified: 2014-02-08

Description:

Multiple cross-site request forgery (CSRF) vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to hijack the authentication of (1) administrators for requests that change the administrator password via an update action to sw/admin_change_password.php or (2) unspecified victims for requests that add a topic or blog entry to sw/add_topic.php. NOTE: vector 2 can be leveraged to bypass the authentication requirements for exploiting vector 1 in CVE-2014-1914.

See advisories in our WLB2 database:

	Topic	Author	Date
Med.	Command School Student Management System V1.06.01 Multiple Vulnerabilties	AtT4CKxT3rR0r1ST	08.01.2014

Type:

CWE-352

(Cross-Site Request Forgery (CSRF))

CVSS2 => (AV:N/AC:M/Au:N/C:P/I:P/A:P)

CVSS Base Score	Impact Subscore	Exploitability Subscore
6.8/10	6.4/10	8.6/10

Exploit range	Attack complexity	Authentication
Remote	Medium	No required
Confidentiality impact	Integrity impact	Availability impact
Partial	Partial	Partial

Affected software
Doug poulin -> Command school student management system

References:

http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html

http://osvdb.org/101890

http://osvdb.org/101889

Copyright 2024, cxsecurity.com