CVE-2021-27885

usersettings.php in e107 through 2.3.0 lacks a certain eTOKEN protection mechanism...

e107 CMS 2.3.0 Cross Site Request Forgery

Exploit Title: e107 CMS 2.3.0 - CSRF Date: 04/03/2021 Exploit Author: Tadjmen Vendor Homepage: https://e107.org Software Link: https://e107.org/download Version: 2.3.0 Tested on: Windows 10 CVE : CVE-2021-27885 CSRF vulnerability on e107 CMS Bug Description Hi. I found a CSRF on the e107 CMS...

CVE-2021-27885

creationtimestamp| type| source ---|---|--- 2021-03-02 22:44:37+00:00| seen| https://t.me/cibsecurity/24362 2021-05-30 02:42:18+00:00| seen| https://t.me/pwnwikizhchannel/534 2024-11-14 06:08:16+00:00| seen| MISP/03114cd9-36b4-48b4-9094-861dbae653e8...

CVE-2021-27885

usersettings.php in e107 through 2.3.0 lacks a certain eTOKEN protection mechanism...

CVE-2021-27885

CVE-2021-27885 affects e107 up to version 2.3.0, due to missing e_TOKEN protection in usersettings.php. This CSRF flaw allows an attacker to coerce actions (e.g., password changes) without authentication, as evidenced by the public CSRF exploit and related vulnerability notes. Public references d...