CVE-2023-41452
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
A CSRF vulnerability in phpkobo AjaxNewTicker version 1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload in the txt parameter of the index.php component.
Risk Assessment
An attacker can exploit this vulnerability to perform unauthorized actions in the context of an administrator session, potentially leading to application takeover and data integrity compromise.
Recommendation
Immediately update phpkobo AjaxNewTicker to the latest available version and implement CSRF protection mechanisms such as anti-CSRF tokens.
Other vulnerabilities in phpkobo AjaxNewTicker
See all- CVE-2023-41447Medium
A Cross Site Scripting (XSS) vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload in the subcmd parameter of the index.php component.
- CVE-2023-41453Medium
A Cross Site Scripting (XSS) vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary JavaScript code via a crafted payload in the 'cmd' parameter of the index.php component.
- CVE-2023-41451Medium
A Cross Site Scripting (XSS) vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary JavaScript code via a crafted payload in the 'txt' parameter of the index.php component.
- CVE-2023-41448Medium
A Cross Site Scripting (XSS) vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary JavaScript code via a crafted payload to the ID parameter in the index.php component.
- CVE-2023-41445Medium
A Cross Site Scripting (XSS) vulnerability in phpkobo AjaxNewTicker version 1.0.5 allows a remote attacker to execute arbitrary JavaScript code via a crafted payload in the index.php component.
Original NVD description (English source)
Cross Site Request Forgery vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the txt parameter in the index.php component.