CVE-2012-3231

CVE-2012-3231 affects web@all 2.0. The CSRF vulnerability resides in actions performed via HTTP requests to inc/browser/action.php (do_addfile), allowing an authenticated administrator to add, delete, or modify sensitive data. A PoC demonstrates how an attacker could forge a request to create an ...

CVE-2012-3232

The CVE-2012-3232 entry relates to web@all 2.0. Affected component: search.php; vulnerability types: CSRF (CVE-2012-3231) and XSS (CVE-2012-3232). Root cause: input passed via the GET parameter _text[title] is not properly sanitized, allowing an attacker to inject arbitrary HTML/script in the use...