CVE-2008-6480: CSRF

Published Mar 16, 2009

Updated

Cross-site request forgery (CSRF) vulnerability in engine/modules/imagepreview.php in Datalife Engine 6.7 allows remote attackers to hijack the authentication of arbitrary users for requests that use a modified image parameter.

Affected Software

1 affected component

Softnews Media Group DataLife Engine=6.7

Event History

Mar 16, 2009

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Data Sourced

via NVD·07:30 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Who can exploit this issue?

A remote attacker can attempt exploitation without authentication by inducing an authenticated DataLife Engine user to send a crafted request.

What user interaction is required?

The affected user must be authenticated and must make a request containing a modified image parameter, typically after being directed to attacker-controlled content.

What is the impact if exploitation succeeds?

The attacker can hijack the authenticated user's authority for affected requests, with potential impact to confidentiality, integrity, and availability.

CVE-2008-6480: CSRF

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What user interaction is required?

What is the impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What user interaction is required?

What is the impact if exploitation succeeds?