CVE-2012-6518 - Vulnerability Details - OpenCVE

Cross-site request forgery (CSRF) vulnerability in mod.php in DiY-CMS 1.0 allows remote attackers to hijack the authentication of administrators for requests that create a poll via an add action to the poll module.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00713.

Key SSVC decision points have not yet been added.

Vendors	Products
Diy-cms Subscribe	Diy-cms Subscribe

Configuration 1 [-]

cpe:2.3:a:diy-cms:diy-cms:1.0:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2012-6368	Cross-site request forgery (CSRF) vulnerability in mod.php in DiY-CMS 1.0 allows remote attackers to hijack the authentication of administrators for requests that create a poll via an add action to the poll module.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://archives.neohapsis.com/archives/bugtraq/2012-04/0213.html
http://packetstormsecurity.org/files/112224/DIY-CMS-1.0-Poll-XSS-CSRF-SQL-Injection.html
http://secunia.com/advisories/49011
http://www.exploit-db.com/exploits/18804
http://www.osvdb.org/81562
http://www.securityfocus.com/bid/53266
http://www.vulnerability-lab.com/get_content.php?id=518
https://exchange.xforce.ibmcloud.com/vulnerabilities/75230

History

No history.

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2013-01-24T01:00:00

Updated: 2024-08-06T21:28:39.949Z

Reserved: 2013-01-23T00:00:00

Link: CVE-2012-6518

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2013-01-24T01:55:05.460

Modified: 2025-04-11T00:51:21.963

Link: CVE-2012-6518

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-352

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2012-04-26T00:00:00", "descriptions": [{"lang": "en", "value": "Cross-site request forgery (CSRF) vulnerability in mod.php in DiY-CMS 1.0 allows remote attackers to hijack the authentication of administrators for requests that create a poll via an add action to the poll module."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-28T12:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "18804", "tags": ["exploit", "x_refsource_EXPLOIT-DB"], "url": "http://www.exploit-db.com/exploits/18804"}, {"name": "20120426 DIY CMS v1.0 Poll - Multiple Web Vulnerabilities", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://archives.neohapsis.com/archives/bugtraq/2012-04/0213.html"}, {"name": "53266", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/53266"}, {"name": "diycms-modfile-csrf(75230)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75230"}, {"name": "49011", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/49011"}, {"name": "81562", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/81562"}, {"tags": ["x_refsource_MISC"], "url": "http://www.vulnerability-lab.com/get_content.php?id=518"}, {"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.org/files/112224/DIY-CMS-1.0-Poll-XSS-CSRF-SQL-Injection.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2012-6518", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Cross-site request forgery (CSRF) vulnerability in mod.php in DiY-CMS 1.0 allows remote attackers to hijack the authentication of administrators for requests that create a poll via an add action to the poll module."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "18804", "refsource": "EXPLOIT-DB", "url": "http://www.exploit-db.com/exploits/18804"}, {"name": "20120426 DIY CMS v1.0 Poll - Multiple Web Vulnerabilities", "refsource": "BUGTRAQ", "url": "http://archives.neohapsis.com/archives/bugtraq/2012-04/0213.html"}, {"name": "53266", "refsource": "BID", "url": "http://www.securityfocus.com/bid/53266"}, {"name": "diycms-modfile-csrf(75230)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75230"}, {"name": "49011", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/49011"}, {"name": "81562", "refsource": "OSVDB", "url": "http://www.osvdb.org/81562"}, {"name": "http://www.vulnerability-lab.com/get_content.php?id=518", "refsource": "MISC", "url": "http://www.vulnerability-lab.com/get_content.php?id=518"}, {"name": "http://packetstormsecurity.org/files/112224/DIY-CMS-1.0-Poll-XSS-CSRF-SQL-Injection.html", "refsource": "MISC", "url": "http://packetstormsecurity.org/files/112224/DIY-CMS-1.0-Poll-XSS-CSRF-SQL-Injection.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T21:28:39.949Z"}, "title": "CVE Program Container", "references": [{"name": "18804", "tags": ["exploit", "x_refsource_EXPLOIT-DB", "x_transferred"], "url": "http://www.exploit-db.com/exploits/18804"}, {"name": "20120426 DIY CMS v1.0 Poll - Multiple Web Vulnerabilities", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://archives.neohapsis.com/archives/bugtraq/2012-04/0213.html"}, {"name": "53266", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/53266"}, {"name": "diycms-modfile-csrf(75230)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75230"}, {"name": "49011", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/49011"}, {"name": "81562", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/81562"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.vulnerability-lab.com/get_content.php?id=518"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://packetstormsecurity.org/files/112224/DIY-CMS-1.0-Poll-XSS-CSRF-SQL-Injection.html"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2012-6518", "datePublished": "2013-01-24T01:00:00", "dateReserved": "2013-01-23T00:00:00", "dateUpdated": "2024-08-06T21:28:39.949Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:diy-cms:diy-cms:1.0:*:*:*:*:*:*:*", "matchCriteriaId": "E7668B54-6DD0-401F-9898-B422E8E418F8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross-site request forgery (CSRF) vulnerability in mod.php in DiY-CMS 1.0 allows remote attackers to hijack the authentication of administrators for requests that create a poll via an add action to the poll module."}, {"lang": "es", "value": "Falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSFR) en mod.php en DiY-CMS v1.0, permite a atacantes remotos secuestrar la autenticaci\u00f3n de los administradores para peticiones que crean una encuesta a trav\u00e9s de una acci\u00f3n de \"a\u00f1adir\" en el m\u00f3dulo de las mismas."}], "id": "CVE-2012-6518", "lastModified": "2025-04-11T00:51:21.963", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2013-01-24T01:55:05.460", "references": [{"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://archives.neohapsis.com/archives/bugtraq/2012-04/0213.html"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://packetstormsecurity.org/files/112224/DIY-CMS-1.0-Poll-XSS-CSRF-SQL-Injection.html"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/49011"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.exploit-db.com/exploits/18804"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/81562"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/53266"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.vulnerability-lab.com/get_content.php?id=518"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75230"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://archives.neohapsis.com/archives/bugtraq/2012-04/0213.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://packetstormsecurity.org/files/112224/DIY-CMS-1.0-Poll-XSS-CSRF-SQL-Injection.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/49011"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.exploit-db.com/exploits/18804"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/81562"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/53266"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.vulnerability-lab.com/get_content.php?id=518"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75230"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "nvd@nist.gov", "type": "Primary"}]}