CVE-2014-4718 in Lunar CMS
Summary
Multiple cross-site request forgery (CSRF) vulnerabilities in Lunar CMS before 3.3-3 allow remote attackers to hijack the authentication of administrators for requests that (1) add Super users via a request to admin/user_create.php or conduct cross-site scripting (XSS) attacks via the (2) email or (3) subject parameter in contact_form.ext.php to admin/extensions.php.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Reservation
07/03/2014
Disclosure
07/03/2014
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 70264 | Lunarcms Lunar CMS cross-site request forgery | 352 | Proof-of-Concept | Official fix | CVE-2014-4718 |