CVE-2017-11679

High

Published: 27/07/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Hashtopus 1.5g has a Cross-Site Request Forgery (CSRF) vulnerability via the password parameter to admin.php in an a=config action.

Risk Assessment

An attacker could exploit this vulnerability to perform unauthorized actions on behalf of a logged-in administrator, potentially leading to serious security breaches.

Recommendation

It is recommended to implement CSRF tokens and update to the latest version of Hashtopus to mitigate the risk.

Other vulnerabilities in Hashtopus 1.5g

CVE-2017-11678High
SQL injection vulnerability in Hashtopus 1.5g allows remote authenticated users to execute arbitrary SQL commands via the format parameter in admin.php.

Original NVD description (English source)

Cross-Site Request Forgery (CSRF) exists in Hashtopus 1.5g via the password parameter to admin.php in an a=config action.