CVE-2019-17553

An issue was discovered in MetInfo v7.0.0 beta. There is SQL Injection via the admin/?n=tags&c=index&a=doSaveTags URI...

PT-2019-18475

Name of the Vulnerable Software and Affected Versions idreamsoft iCMS version 7.0.13 Description An issue was discovered that allows directory traversal via the app parameter, set to /../, in the "admincp.php?app=apps&do=save" endpoint. This can lead to the creation of a ZIP archive file containi...

CVE-2018-16366

An issue was discovered in idreamsoft iCMS V7.0.10. admincp.php?app=user&do=save allows CSRF...

CVE-2018-16365: Cross-Site Request Forgery (CSRF)

An issue was discovered in idreamsoft iCMS V7.0.10. admincp.php?app=group&do=save allows CSRF...

PT-2018-13521

Name of the Vulnerable Software and Affected Versions idreamsoft iCMS version 7.0.10 Description An issue was discovered that allows Cross-Site Request Forgery CSRF attacks. The "admincp.php?app=user&do=save" endpoint is vulnerable to this issue. Recommendations For idreamsoft iCMS version 7.0.10...

PT-2018-13520

Name of the Vulnerable Software and Affected Versions idreamsoft iCMS version 7.0.10 Description An issue was discovered that allows Cross-Site Request Forgery CSRF attacks. The "admincp.php?app=group&do=save" endpoint is vulnerable to this issue. Recommendations For idreamsoft iCMS version 7.0.1...

CVE-2018-10222

An issue was discovered in idreamsoft iCMS V7.0. There is a CSRF vulnerability that can add a Column via /admincp.php?app=articlecategory&do=save&frame=iPHP...

PT-2018-9691

Name of the Vulnerable Software and Affected Versions: idreamsoft iCMS version 7.0.7 Description: An issue was discovered in idreamsoft iCMS, where there is a CSRF vulnerability. This vulnerability can be exploited to add an admin account via the "admincp.php?app=members&do=save&frame=iPHP"...

CVE-2018-9923

An issue was discovered in idreamsoft iCMS through 7.0.7. CSRF exists in admincp.php, as demonstrated by adding an article via an app=article&do=save&frame=iPHP request...

PT-2018-19091

Name of the Vulnerable Software and Affected Versions idreamsoft iCMS versions prior to 7.0.8 Description An issue exists where CSRF is present in the admincp.php file. This can be demonstrated by adding an article via the "app=article&do=save&frame=iPHP" request to the "/admincp.php" endpoint,...

CSRF vulnerability in icms backend

iCMS is an efficient content management system for small and medium-sized websites. A csrf vulnerability exists in the latest version of iCMS. Because the token is not validated in the /app/admincp/account.app.php dosave operation, an attacker can modify the administrator account password by...