CVE-2017-12838
HighSummary
The CSRF vulnerability in NexusPHP 1.5 allows remote attackers to hijack user authentication for specific requests, such as sending manas or adding administrators.
Risk Assessment
An attacker can exploit this vulnerability to gain unauthorized access to user accounts, potentially leading to serious security breaches within the system.
Recommendation
It is recommended to update to the latest version of NexusPHP and implement CSRF protection mechanisms to minimize risk.
Other vulnerabilities in NexusPHP 1.5
See all- CVE-2017-14512Critical
NexusPHP version 1.5.beta5.20120707 has an SQL Injection vulnerability in forummanage.php via the sort parameter in an editforum action. This is a different vulnerability than CVE-2017-12981.
- CVE-2017-14076Critical
SQL Injection exists in NexusPHP version 1.5.beta5.20120707 via the id parameter to linksmanage.php in an editlink action.
- CVE-2017-14069Critical
SQL Injection exists in NexusPHP version 1.5.beta5.20120707 via the usernw array parameter to nowarn.php.
- CVE-2017-13669Critical
SQL Injection exists in NexusPHP version 1.5.beta5.20120707 via the setanswered parameter to staffbox.php.
- CVE-2017-12679Critical
SQL Injection exists in NexusPHP version 1.5.beta5.20120707 via the delcheater parameter to cheaterbox.php.
- CVE-2017-12981Critical
NexusPHP version 1.5.beta5.20120707 has an SQL Injection vulnerability in forummanage.php via the sort parameter in an addforum action.
- CVE-2017-12776Critical
SQL injection vulnerability in reports.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the delreport parameter.
- CVE-2017-12910Critical
CVE-2017-12910 is an SQL injection vulnerability in massmail.php in NexusPHP 1.5 that allows remote attackers to execute arbitrary SQL commands via the or parameter.
- CVE-2017-12909Critical
An SQL injection vulnerability in modtask.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the userid parameter.
- CVE-2017-12908Critical
SQL injection vulnerability in takeconfirm.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the conusr parameter.
Original NVD description (English source)
Cross-site request forgery (CSRF) vulnerability in NexusPHP 1.5 allows remote attackers to hijack the authentication of users for requests that (1) send manas via a request to mybonus.php or (2) add administrators via unspecified vectors.