111 matches found
CVE-2018-16239: Use of Insufficiently Random Values
An issue was discovered in damiCMS V6.0.1. It relies on the PHP time function for cookies, which makes it possible to determine the cookie for an existing admin session via 10800 guesses...
CVE-2018-16238: Improper Input Validation
An issue was discovered in damiCMS V6.0.1. Remote code execution can occur via PHP code in a multipart/form-data POST to the admin.php?s=/Tpl/Update.html URI. For example, this can update the Web/Tpl/default/head.html file...
DamiCMS Cross-Site Request Forgery Vulnerability (CNVD-2018-16532)
DamiCMS is a content management system CMS for building websites quickly. A cross-site request forgery vulnerability exists in DamiCMS version 6.0.0. A remote attacker can exploit this vulnerability to change the password of the administrator account with the help of the /admin.php?s=/Admin/doedi...
Cross site request forgery (csrf)
An issue was discovered in DamiCMS 6.0.0. There is an CSRF vulnerability that can revise the administrator account's password via /admin.php?s=/Admin/doedit...
CVE-2018-15844
An issue was discovered in DamiCMS 6.0.0. There is an CSRF vulnerability that can revise the administrator account's password via /admin.php?s=/Admin/doedit...
CVE-2018-15844
An issue was discovered in DamiCMS 6.0.0. There is an CSRF vulnerability that can revise the administrator account's password via /admin.php?s=/Admin/doedit...
CVE-2018-15844
An issue was discovered in DamiCMS 6.0.0. There is an CSRF vulnerability that can revise the administrator account's password via /admin.php?s=/Admin/doedit...
CVE-2018-15844
DamiCMS 6.0.0 is affected by a Cross-Site Request Forgery vulnerability that can change the administrator password via /admin.php?s=/Admin/doedit. Root cause identified as CSRF in the admin password edit flow; PoC and public writeups exist (e.g., Exploit-DB record for 6.0.0 CSRF). The vulnerabili...
CVE-2018-15844: Cross-Site Request Forgery (CSRF)
An issue was discovered in DamiCMS 6.0.0. There is an CSRF vulnerability that can revise the administrator account's password via /admin.php?s=/Admin/doedit...
DamiCMS has an arbitrary file deletion vulnerability
DamiCMS is a content management system CMS for building websites quickly. DamiCMS v6.0.0 has an arbitrary file deletion vulnerability, the vulnerability stems from the failure to filter file parameters in the file deletion operation on the template edit page, which can be exploited by an attacker...
DamiCMS has an arbitrary file write vulnerability
DamiCMS is a content management system CMS for building websites quickly. DamiCMS v6.0.0 version exists arbitrary file write vulnerability, the vulnerability stems from the template editing page fails to strictly detect the file name suffix, an attacker can exploit the vulnerability to write...
CVE-2018-13031
DamiCMS v6.0.0 aand 6.1.0 allows CSRF via admin.php?s=/Admin/doadd to add an administrator account...
CVE-2018-13031
DamiCMS v6.0.0 aand 6.1.0 allows CSRF via admin.php?s=/Admin/doadd to add an administrator account...
Cross site request forgery (csrf)
DamiCMS v6.0.0 aand 6.1.0 allows CSRF via admin.php?s=/Admin/doadd to add an administrator account...
CVE-2018-13031
DamiCMS v6.0.0 aand 6.1.0 allows CSRF via admin.php?s=/Admin/doadd to add an administrator account...
CVE-2018-13031
DamiCMS CVE-2018-13031 affects versions 6.0.0 and 6.1.0 . The vulnerability is a Cross-Site Request Forgery (CSRF) on the endpoint admin.php?s=/Admin/doadd, allowing an attacker to add an administrator account. The root cause is insufficient CSRF protection on that admin action; the impact is the...
CVE-2018-13031: Cross-Site Request Forgery (CSRF)
DamiCMS v6.0.0 aand 6.1.0 allows CSRF via admin.php?s=/Admin/doadd to add an administrator account...
DAMICMS 6.0.0 - Cross-Site Request Forgery (Add Admin) Vulnerability
Exploit for php platform in category web applications...
