CVE-2015-3140
HIGHSynametrics SynaMan Syncrify SynTail - Cross-Site Request Forgery
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2015-3140. PoCs published by Marlow Tannhauser.
AI-analyzed exploit summary This exploit demonstrates CSRF and stored XSS vulnerabilities in SynTail 1.5 Build 566. It includes PoC HTML forms that submit malicious payloads to create a new file bundle or user, leveraging persistent JSESSIONID for authentication bypass.
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in Synametrics Technologies SynaMan before 3.5 Build 1451, Syncrify before 3.7 Build 856, and SynTail before 1.5 Build 567
Exploits (3)
This exploit demonstrates CSRF and stored XSS vulnerabilities in SynTail 1.5 Build 566. It includes PoC HTML forms that submit malicious payloads to create a new file bundle or user, leveraging persistent JSESSIONID for authentication bypass.
The exploit demonstrates CSRF and stored XSS vulnerabilities in Syncrify Server 3.6 Build 833. It includes PoC HTML snippets that leverage CSRF to modify SMTP settings and administrator passwords, as well as stored XSS payloads in user fields and email configurations.
This exploit demonstrates CSRF and stored XSS vulnerabilities in SynaMan 3.4 Build 1436. It includes PoC code for creating a shared folder and a new user via CSRF, as well as identifying multiple stored XSS vulnerabilities in various input fields.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H