Cross site request forgery (csrf)

2019-05-2418:29:00

PRIOn knowledge base

www.prio-n.com

7.2 High

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

60.7%

JSON

Kliqqi 3.0.0.5 allows CSRF with resultant Arbitrary File Upload because module.php?module=upload can be used to configure the uploading of .php files, and then modules/upload/upload_main.php can be used for the upload itself.

CPENameOperatorVersion
kliqqi_cmseq3.0.0.5

CPE	Name	Operator	Version
	kliqqi_cms	eq	3.0.0.5

References

blog.ripstech.com/2016/kliqqi-from-cross-site-request-forgery-to-code-execution/

demo.ripstech.com/projects/kliqqi_3.0.0.5