Cross site request forgery (csrf)

2020-09-1720:15:00

PRIOn knowledge base

www.prio-n.com

9.2 High

AI Score

Confidence

High

0.019 Low

EPSS

Percentile

88.6%

JSON

The SOY Inquiry component of SOY CMS is affected by Cross-site Request Forgery (CSRF) and Remote Code Execution (RCE). The vulnerability affects versions 2.0.0.3 and earlier of SOY Inquiry. This allows remote attackers to force the administrator to edit files once the administrator loads a specially crafted webpage. An administrator must be logged in for exploitation to be possible. This issue is fixed in SOY Inquiry version 2.0.0.4 and included in SOY CMS 3.0.2.328.

CPENameOperatorVersion
soy_cmslt3.0.2.328
soy_inquirylt2.0.0.4

CPE	Name	Operator	Version
	soy_cms	lt	3.0.2.328
	soy_inquiry	lt	2.0.0.4

References

github.com/inunosinsi/soycms/pull/15

github.com/inunosinsi/soycms/security/advisories/GHSA-j2qw-747j-mfv4

youtu.be/ffvKH3gwyRE