Cross site request forgery (csrf)

An issue was discovered in EmpireCMS 7.0. There is a CSRF vulnerability that can add administrators via upload/e/admin/user/AddUser.php?enews=AddUser...

CVE-2018-16339: Cross-Site Request Forgery (CSRF)

An issue was discovered in EmpireCMS 7.0. There is a CSRF vulnerability that can add administrators via upload/e/admin/user/AddUser.php?enews=AddUser...

PT-2018-13501

Name of the Vulnerable Software and Affected Versions EmpireCMS version 7.0 Description A CSRF issue allows adding administrators via the "upload/e/admin/user/AddUser.php?enews=AddUser" endpoint. This can be exploited to add new administrators without proper authorization. Recommendations For...

Cross-site Request Forgery (CSRF)

CMS Made Simple is vulnerable to cross-site request forgery CSRF attacks. A malicious user can hijack the authentication of admins for requests to create accounts through an admin/adduser.php requests...

CVE-2016-7904

CMS Made Simple CVE-2016-7904 is a CSRF in admin/adduser.php that lets an attacker hijack admin authentication to create accounts on versions before 2.1.6. Impact includes unauthorized admin account creation; remediation is to upgrade to 2.1.6 or newer.

CVE-2016-7904

Cross-site request forgery CSRF vulnerability in CMS Made Simple before 2.1.6 allows remote attackers to hijack the authentication of administrators for requests that create accounts via an admin/adduser.php request...

CVE-2016-7904: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in CMS Made Simple before 2.1.6 allows remote attackers to hijack the authentication of administrators for requests that create accounts via an admin/adduser.php request...

Malware exploit: Vertexnet V1.1.1

Type: Flood Bots Author: Xylitol !/usr/bin/perl VertexNet v1.1.1 Flood Bots http://www.virustotal.com/file-scan/report.html?id=fd373a8f4adf29001d282b963f126f760afcf3e58117f6024b2d65a36d41f617-1305491791 Xyl2k! :þ use HTTP::Request; use LWP::UserAgent; $URL = "http://localhost/Panel/adduser.php";...

ITA Forum <= 1.49 SQL Injection Exploit

No description provided by source. !/usr/bin/perl use LWP::UserAgent; ITA Forum 1.49 sql injection exploit with one char bruteforce by 1dt.w0lf // r57 :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: example: r57ita.pl http://127.0.0.1/ITA...

myBloggie 2.1.2/2.1.3 adduser.php errormsg Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/17048/info MyBloggie is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to have...

CVE-2010-2685

siteadmin/adduser.php in Customer Paradigm PageDirector CMS does not properly restrict access, which allows remote attackers to bypass intended restrictions and add administrative users via a direct request...

CVE-2010-2685

CVE-2010-2685 concerns Customer Paradigm PageDirector CMS. The issue arises from improper access control in siteadmin/adduser.php, allowing remote attackers to bypass restrictions and add administrative users via a direct request. The vulnerability is documented with a high severity (CVSS v2 base...

CVE-2010-2685: Undefined Security Weakness

siteadmin/adduser.php in Customer Paradigm PageDirector CMS does not properly restrict access, which allows remote attackers to bypass intended restrictions and add administrative users via a direct request...

PageDirector CMS - Multiple Vulnerabilities

PageDirector CMS - Multiple Vulnerabilities Exploit Title : PageDirector CMS Multiple Vulnerabilities Date : 20 - 6 - 2010 Author : Tr0y-x Vendor : www.customerparadigm.com Version : All Versions Tested on : Linux Home : WwW.SeC-WaR.CoM Price : 675.00 $ loooooolz -== SQL Injection Vulenrability =...

Authentication flaw

AlkalinePHP 0.77.35 and earlier allows remote attackers to bypass authentication and gain administrative access by creating an admin account via a direct request to adduser.php...

Authentication flaw

MeltingIce File System 1.0 allows remote attackers to bypass application authentication, create new user accounts, and exceed application quotas via a direct request to admin/adduser.php...

CVE-2008-2348

MeltingIce File System 1.0 allows remote attackers to bypass application authentication, create new user accounts, and exceed application quotas via a direct request to admin/adduser.php...

CVE-2008-2346

AlkalinePHP 0.77.35 and earlier allows remote attackers to bypass authentication and gain administrative access by creating an admin account via a direct request to adduser.php...

CVE-2008-2348

MeltingIce File System 1.0 allows remote attackers to bypass application authentication, create new user accounts, and exceed application quotas via a direct request to admin/adduser.php...

CVE-2008-2346

CVE-2008-2346 affects AlkalinePHP versions 0.77.35 and earlier. The vulnerability allows remote attackers to bypass authentication and gain administrative access by issuing a direct request to adduser.php to create an admin account. The connected documents confirm the root cause as an authenticat...