CVE-2020-18324

There are CSRF vulnerabilities in Subrion CMS versions 4.1.x through 4.1.5 and before 4.2.0 due to a logic error. Although there is functionality to detect CSRF, it is called too late in the ia.core.php code, allowing attacks against the query parameter to the panel/database.

Subrion CMS version 4.0.5 has a CSRF vulnerability in the admin/blog/add/ module. An attacker can add any tag and optionally inject XSS via the tags parameter.

Subrion CMS version 4.0.5 has a CSRF vulnerability in the admin/blocks/add/ module that allows an attacker to create any blocks. Additionally, the attacker can optionally inject XSS via the content parameter.

Subrion CMS version 4.0.5 has a CSRF vulnerability in the language editing module. An attacker can perform any Edit Language action and optionally inject XSS via the title parameter.

Subrion CMS version 4.0.5.10 has a CSRF vulnerability in the admin/blog/add/ module. An attacker can add any blog entry and optionally inject XSS via the body parameter.

Subrion CMS before 4.1.6 has a SQL injection vulnerability in /front/actions.php via the $_POST array.

Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $_GET array.

Subrion CMS version 4.0.5.10 has an SQL injection vulnerability in the admin/database module via the query parameter.

In Subrion CMS version 4.0.5, a vulnerability allows remote attackers to conduct PHP Object Injection attacks via crafted serialized data in a salt cookie in a login request.

A vulnerability was found in Intelliants Subrion CMS up to version 4.2.1 in the iaUsers::authorize function. Manipulation of the $_SERVER['HTTP_REFERER'] argument causes open redirect. The attack can be performed remotely and the exploit has been made public.