CVEvulnerability
CVE-2012-1897
6.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2012-10-01
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-352
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in Wolf CMS 0.75 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) delete users via the user id number to admin/user/delete; (2) delete pages via the page id number to admin/page/delete; delete the (3) images or (4) themes directory via the directory name to admin/plugin/file_manager/delete, and possibly other directories; or (5) logout the user via a request to admin/login/logout.
Affected configurations
• wolfcms wolf cms (<= 0.7.5)
• wolfcms wolf cms 0.5.0
• wolfcms wolf cms 0.5.5
• wolfcms wolf cms 0.6.0
• wolfcms wolf cms 0.7.0
• wolfcms wolf cms 0.7.2
• wolfcms wolf cms 0.7.3
Related
Weakness · CWE (1)
- CWE-352 Cross-Site Request Forgery weakness
References
- http://packetstormsecurity.org/files/111116/Wolfcms-0.75-Cross-Site-Request-Forgery-Cross-Site-Scripting.html Exploit
- http://secunia.com/advisories/48520 Vendor Advisory
- http://www.webapp-security.com/2012/03/wolfcms/ www.webapp-security.com
- http://www.webapp-security.com/wp-content/uploads/2012/03/Wolfcms-0.75-Multiple-Vulnerabilities-CSRF-XSS.txt Exploit
- http://packetstormsecurity.org/files/111116/Wolfcms-0.75-Cross-Site-Request-Forgery-Cross-Site-Scripting.html Exploit
- http://secunia.com/advisories/48520 Vendor Advisory
- http://www.webapp-security.com/2012/03/wolfcms/ www.webapp-security.com
- http://www.webapp-security.com/wp-content/uploads/2012/03/Wolfcms-0.75-Multiple-Vulnerabilities-CSRF-XSS.txt Exploit