CVE-2011-5318

Diafan.cms < 5.0 - CSRF

Title source: rule

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in diafan.CMS before 5.1 allow remote attackers to hijack the authentication of administrators for requests that (1) modify articles via a save_post action to admin/news/saveNEWS_ID/, (2) modify settings via a save_post action to admin/site/save2/, or (3) modify credentials via a save_post action to admin/usersite/save2/.

Exploits (1)

exploitdb WORKING POC

by High-Tech Bridge SA · textwebappsphp

https://www.exploit-db.com/exploits/15969

View Code ZIP pw:eip

References (1)

Core 1

Core References

Exploit x_refsource_misc

https://www.htbridge.com/advisory/HTB22775

Scores

EPSS 0.0031

EPSS Percentile 54.1%

Details

CWE

CWE-352

Status published

Products (1)

diafan/diafan.cms < 5.0

Published Jan 01, 2015

Tracked Since Feb 18, 2026