Realtyna RPL up to 8.9.4 on Joomla com_rpl administrator/index.php Request cross-site request forgery

Summaryinfo

A vulnerability classified as problematic has been found in Realtyna RPL up to 8.9.4 on Joomla. This affects an unknown function of the file administrator/index.php of the component com_rpl. This manipulation as part of Request causes cross-site request forgery. This vulnerability is registered as CVE-2015-7715. Remote exploitation of the attack is possible. Furthermore, an exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Realtyna RPL up to 8.9.4 on Joomla (Joomla Component) and classified as problematic. Affected by this vulnerability is some unknown processing of the file administrator/index.php of the component com_rpl. The manipulation as part of a Request leads to a cross-site request forgery vulnerability. The CWE definition for the vulnerability is CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. As an impact it is known to affect integrity. The summary by CVE is:

Cross-site request forgery (CSRF) vulnerability in the Realtyna RPL (com_rpl) component before 8.9.5 for Joomla! allows remote attackers to hijack the authentication of administrators for requests that add a user via an add_user action to administrator/index.php.

The bug was discovered 10/23/2015. The weakness was published 10/18/2017 as EDB-ID 38528 as confirmed exploit (Exploit-DB). It is possible to read the advisory at exploit-db.com. This vulnerability is known as CVE-2015-7715 since 10/06/2015. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details and also a public exploit are known.

A public exploit has been developed by Bikramaditya Guha and been published even before and not after the advisory. It is possible to download the exploit at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 726 days. During that time the estimated underground price was around $0-$5k. By approaching the search of inurl:administrator/index.php it is possible to find vulnerable targets with Google Hacking. The commercial vulnerability scanner Qualys is able to test this issue with plugin 11553 (Joomla! Realtyna RPL Extension Cross-Site Scripting and Cross-Site Request Forgery Vulnerabilities).

Upgrading to version 8.9.5 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (38528). Similar entry is available at VDB-107994. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Joomla Component

Vendor

• Realtyna

Name

• RPL

Version

• 8.9.0
• 8.9.1
• 8.9.2
• 8.9.3
• 8.9.4

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion