kalcaddle KodExplorer up to 4.49 cross-site request forgery

Summaryinfo

A vulnerability was found in kalcaddle KodExplorer up to 4.49 and classified as problematic. This issue affects some unknown processing. Such manipulation leads to cross-site request forgery. This vulnerability is referenced as CVE-2022-4944. It is possible to launch the attack remotely. Furthermore, an exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in kalcaddle KodExplorer up to 4.49. Affected by this issue is an unknown code. The manipulation with an unknown input leads to a cross-site request forgery vulnerability. Using CWE to declare the problem leads to CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. Impacted is integrity.

The weakness was published 04/21/2023 as 512. The advisory is shared for download at github.com. This vulnerability is handled as CVE-2022-4944. Successful exploitation requires user interaction by the victim. Technical details are unknown but a public exploit is available.

The exploit is available at mediafire.com. It is declared as proof-of-concept.

Upgrading to version 4.50 eliminates this vulnerability. The upgrade is hosted for download at github.com.

The vulnerability is also documented in the vulnerability database at Exploit-DB (51388). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• kalcaddle

Name

• KodExplorer

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7
• 4.8
• 4.9
• 4.10
• 4.11
• 4.12
• 4.13
• 4.14
• 4.15
• 4.16
• 4.17
• 4.18
• 4.19
• 4.20
• 4.21
• 4.22
• 4.23
• 4.24
• 4.25
• 4.26
• 4.27
• 4.28
• 4.29
• 4.30
• 4.31
• 4.32
• 4.33
• 4.34
• 4.35
• 4.36
• 4.37
• 4.38
• 4.39
• 4.40
• 4.41
• 4.42
• 4.43
• 4.44
• 4.45
• 4.46
• 4.47
• 4.48
• 4.49

Website

• Product: https://github.com/kalcaddle/KodExplorer/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #116770: KodExplorer <= 4.49 - Cross-site Request Forgery (CSRF) to Remote Code Execution (RCE) (by mrempy)

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion