CVE-2018-16449: Cross-Site Request Forgery (CSRF)

OneThink 1.1.141212 allows CSRF for adding a page via admin.php?s=/Channel/add.html, adding a blog via admin.php?s=/Article/update.html, and setting the audit state via admin.php?s=/Article/setStatus/status/1.html...

PT-2018-13576

Name of the Vulnerable Software and Affected Versions OneThink version 1.1.141212 Description The issue allows for Cross-Site Request Forgery CSRF attacks, which can be used to perform unauthorized actions on the application. Specifically, it affects the addition of pages via...

Cross site request forgery (csrf)

An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/AuthManager/addToGroup.html that can endow administrator privileges...

CVE-2018-15197

An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/AuthManager/addToGroup.html that can endow administrator privileges...

CVE-2018-15197

An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/AuthManager/addToGroup.html that can endow administrator privileges...

CVE-2018-15198

An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/User/add.html that can add a user...

Cross site request forgery (csrf)

An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/User/add.html that can add a user...

CVE-2018-15197

An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/AuthManager/addToGroup.html that can endow administrator privileges...

CVE-2018-15198

An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/User/add.html that can add a user...

CVE-2018-15197

CVE-2018-15197 affects OneThink v1.1. A CSRF in admin.php?s=/AuthManager/addToGroup.html could grant administrator privileges, enabling privilege escalation. The issue is described across multiple feeds (NVD/Red Hat/CVEs) as allowing an attacker to endow admin rights; no public exploit details or...

CVE-2018-15198

CVE-2018-15198 affects OneThink v1.1. A CSRF in admin.php?s=/User/add.html can add a user. Exploitation context and impact are described (CVSS2/3: base scores 6.8/8.8; network vector, no auth, user interaction required). No remediation/patch details are provided in the connected documents; no add...

OneThink Cross-Site Request Forgery Vulnerability (CNVD-2018-14976)

Onethink is a ThinkPHP-based content management framework for web development . A cross-site request forgery vulnerability exists in the admin.php?s=/User/add.html page in OneThink version 1.1. A remote attacker can exploit this vulnerability to add users...

OneThink Cross-Site Request Forgery Vulnerability

Onethink is a ThinkPHP-based content management framework for web development . A cross-site request forgery vulnerability exists in the admin.php?s=/AuthManager/addToGroup.html page in OneThink version 1.1. A remote attacker can exploit this vulnerability to gain administrator privileges...

CVE-2018-15197: Cross-Site Request Forgery (CSRF)

An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/AuthManager/addToGroup.html that can endow administrator privileges...

PT-2018-12941

Name of the Vulnerable Software and Affected Versions OneThink version 1.1 Description A CSRF issue was found in the admin.php?s=/AuthManager/addToGroup.html endpoint, allowing for the potential granting of administrator privileges. Recommendations For OneThink version 1.1, as a temporary...

PT-2018-12942

Name of the Vulnerable Software and Affected Versions OneThink version 1.1 Description An issue was discovered that allows for a CSRF vulnerability. The vulnerability can be exploited through the "admin.php?s=/User/add.html" endpoint, which can add a user. Recommendations For OneThink version 1.1...

CVE-2018-15198: Cross-Site Request Forgery (CSRF)

An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/User/add.html that can add a user...

Onethink Ueditor Server-Side Request Forgery Vulnerability

Onethink is a content management framework for web development based on ThinkPHP.Ueditor is one of the HTML editors. A server-side request forgery vulnerability exists in the getRemoteImage.php file of Ueditor in Onethink version 1.0 and 1.1. A remote attacker can exploit this vulnerability with...

CVE-2017-14323

SSRF Server Side Request Forgery in getRemoteImage.php in Ueditor in Onethink V1.0 and V1.1 allows remote attackers to obtain sensitive information, attack intranet hosts, or possibly trigger remote command execution via the upfile parameter...

CVE-2017-14323

SSRF Server Side Request Forgery in getRemoteImage.php in Ueditor in Onethink V1.0 and V1.1 allows remote attackers to obtain sensitive information, attack intranet hosts, or possibly trigger remote command execution via the upfile parameter...