CVE-2017-16244

High

Published: 01/11/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

OctoberCMS 1.0.426 is vulnerable to Cross-Site Request Forgery (CSRF) due to improper validation of CSRF tokens for postback handling, allowing an attacker to take over the victim's account. The attack bypasses a protection mechanism involving X-CSRF headers and CSRF tokens via a certain _handler postback variable.

Risk Assessment

This vulnerability may lead to account takeover, posing a serious threat to the security of organizational data. An attacker could gain access to sensitive information and perform unauthorized actions on behalf of the victim.

Recommendation

It is recommended to update to the latest version of OctoberCMS that addresses this vulnerability. Additionally, implementing further security measures to minimize the risk of CSRF attacks is advisable.

Other vulnerabilities in OctoberCMS 1.0.426

CVE-2026-100909High
Vulnerability in OctoberCMS up to versions 4.1.19/4.2.25/4.3.4 in the getSourcePathForResize function of modules/system/classes/ResizeImages.php. Manipulation of the realSourcePath argument leads to server-side request forgery (SSRF). Remote attack possible, exploit public. Upgrading to 4.3.5 or 4.4.0 resolves the issue.

Original NVD description (English source)

Cross-Site Request Forgery exists in OctoberCMS 1.0.426 (aka Build 426) due to improper validation of CSRF tokens for postback handling, allowing an attacker to successfully take over the victim's account. The attack bypasses a protection mechanism involving X-CSRF headers and CSRF tokens via a certain _handler postback variable.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS