20120103 OpenKM 5.1.7 OS Command Execution (XSRF based)mailing list
http://archives.neohapsis.com/archives/bugtraq/2012-01/0008.html CVE-2012-2316
OpenKM Document Management System 5.1.7 - Command Execution
Record summary
CVE-2012-2316 has a selected CVSS score of 6.8; EIP currently links 1 catalogued exploit.
Description
Cross-site request forgery (CSRF) vulnerability in servlet/admin/AuthServlet.java in OpenKM 5.1.7 and other versions before 5.1.8-2 allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary code via the script parameter to admin/scripting.jsp.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Proofs of concept
1Catalogued exploits
ExploitDBOpenKM Document Management System 5.1.7 - Command ExecutionExploitDB exploitby Cyrill BrunschwilerNot analyzed1 file
References
11openkm.svn.sourceforge.netConfirmation
http://openkm.svn.sourceforge.net/viewvc/openkm?view=revision&revision=7406 47420Third-party advisory
http://secunia.com/advisories/47420 wiki.openkm.comConfirmation
http://wiki.openkm.com/index.php/Changelog [oss-security] 20120323 CVE-request: OpenKM 5.1.7 Privilege Escalation / OS Command Execution (XSRF based)mailing list
http://www.openwall.com/lists/oss-security/2012/03/23/6 [oss-security] 20120323 Re: CVE-request: OpenKM 5.1.7 Privilege Escalation / OS Command Execution (XSRF based)mailing list
http://www.openwall.com/lists/oss-security/2012/03/23/8 [oss-security] 20120427 Re: CVE-request: OpenKM 5.1.7 Privilege Escalation / OS Command Execution (XSRF based)mailing list
http://www.openwall.com/lists/oss-security/2012/04/27/6 [oss-security] 20120504 Re: CVE-request: OpenKM 5.1.7 Privilege Escalation / OS Command Execution (XSRF based)mailing list
http://www.openwall.com/lists/oss-security/2012/05/04/13 [oss-security] 20120504 Re: CVE-request: OpenKM 5.1.7 Privilege Escalation / OS Command Execution (XSRF based)mailing list
http://www.openwall.com/lists/oss-security/2012/05/04/2 78106vdb entry
http://www.osvdb.org/78106 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2012-2316