CVE-2017-15063
HighSummary
There are CSRF vulnerabilities in Subrion CMS versions 4.1.x through 4.1.5 and before 4.2.0 due to a logic error. Although there is functionality to detect CSRF, it is called too late in the ia.core.php code, allowing attacks against the query parameter to the panel/database.
Risk Assessment
The organization may be exposed to CSRF attacks that could lead to unauthorized access to data or execution of unwanted operations within the system.
Recommendation
It is recommended to update Subrion CMS to version 4.2.0 or later to eliminate these vulnerabilities and implement additional security measures against CSRF attacks.
Other vulnerabilities in Subrion CMS
See all- CVE-2017-6069High
Subrion CMS version 4.0.5 has a CSRF vulnerability in the admin/blog/add/ module. An attacker can add any tag and optionally inject XSS via the tags parameter.
- CVE-2017-6068High
Subrion CMS version 4.0.5 has a CSRF vulnerability in the admin/blocks/add/ module that allows an attacker to create any blocks. Additionally, the attacker can optionally inject XSS via the content parameter.
- CVE-2017-6066High
Subrion CMS version 4.0.5 has a CSRF vulnerability in the language editing module. An attacker can perform any Edit Language action and optionally inject XSS via the title parameter.
- CVE-2017-6002High
Subrion CMS version 4.0.5.10 has a CSRF vulnerability in the admin/blog/add/ module. An attacker can add any blog entry and optionally inject XSS via the body parameter.
- CVE-2017-11445Critical
Subrion CMS before 4.1.6 has a SQL injection vulnerability in /front/actions.php via the $_POST array.
- CVE-2017-11444Critical
Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $_GET array.
- CVE-2017-6013Critical
Subrion CMS version 4.0.5.10 has an SQL injection vulnerability in the admin/database module via the query parameter.
- CVE-2017-5543Critical
In Subrion CMS version 4.0.5, a vulnerability allows remote attackers to conduct PHP Object Injection attacks via crafted serialized data in a salt cookie in a login request.
- CVE-2026-96773Medium
A vulnerability was found in Intelliants Subrion CMS up to version 4.2.1 in the iaUsers::authorize function. Manipulation of the $_SERVER['HTTP_REFERER'] argument causes open redirect. The attack can be performed remotely and the exploit has been made public.
- CVE-2026-96772Medium
A vulnerability was found in Intelliants Subrion CMS up to version 4.2.1 in the file /actions.json?action=assign-owner. Manipulation of the q argument leads to information disclosure. The attack can be executed remotely and the exploit has been released.
Original NVD description (English source)
There are CSRF vulnerabilities in Subrion CMS 4.1.x through 4.1.5, and before 4.2.0, because of a logic error. Although there is functionality to detect CSRF, it is called too late in the ia.core.php code, allowing (for example) an attack against the query parameter to panel/database.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS