CVE-2008-6480: CSRF
Published Mar 16, 2009
·Updated
Cross-site request forgery (CSRF) vulnerability in engine/modules/imagepreview.php in Datalife Engine 6.7 allows remote attackers to hijack the authentication of arbitrary users for requests that use a modified image parameter.
Affected Software
1 affected component
Softnews Media Group DataLife Engine=6.7
Event History
Mar 16, 2009
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Data Sourced
via NVD·07:30 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
Who can exploit this issue?
A remote attacker can attempt exploitation without authentication by inducing an authenticated DataLife Engine user to send a crafted request.
2
What user interaction is required?
The affected user must be authenticated and must make a request containing a modified image parameter, typically after being directed to attacker-controlled content.
3
What is the impact if exploitation succeeds?
The attacker can hijack the authenticated user's authority for affected requests, with potential impact to confidentiality, integrity, and availability.