A vulnerability was found in arnoldle submitByMailPlugin 1.0b2.9 and classified as problematic. This issue affects an unknown functionality of the file edit_list.php. The manipulation with an unknown input leads to a cross-site request forgery vulnerability. Using CWE to declare the problem leads to CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. Impacted is integrity.

The weakness was published 02/19/2023 as a739f680a1623d22f52ff1371e86ca472e63756f. It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2015-10081. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

By approaching the search of inurl:edit_list.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.0b2.9a eliminates this vulnerability. Applying the patch a739f680a1623d22f52ff1371e86ca472e63756f is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version. The advisory contains the following remark:

Added csrf prevention to edit_list.php

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• arnoldle

Name

• submitByMailPlugin

Version

• 1.0b2.9

License

• open-source

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion