CVE-2010-3271
published 2011-07-18CVE-2010-3271: Multiple cross-site request forgery (CSRF) vulnerabilities in the Integrated Solutions Console (aka administrative console) in IBM WebSphere Application Server…
PriorityP434medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EXPLOIT
EPSS
2.10%
79.7th percentile
Multiple cross-site request forgery (CSRF) vulnerabilities in the Integrated Solutions Console (aka administrative console) in IBM WebSphere Application Server (WAS) 7.0.0.13 and earlier allow remote attackers to hijack the authentication of administrators for requests that disable certain security options via an Edit action to console/adminSecurityDetail.do followed by a save action to console/syncworkspace.do.
Affected
139 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | websphere_application_server | <= 7.0.0.13 | — |
| ibm | websphere_application_server | — | — |
| ibm | websphere_application_server | — | — |
| ibm | websphere_application_server | — | — |
| ibm | websphere_application_server | — | — |
| ibm | websphere_application_server | — | — |
| ibm | websphere_application_server | — | — |
| ibm | websphere_application_server | — | — |
| ibm | websphere_application_server | — | — |
| ibm | websphere_application_server | — | — |
| ibm | websphere_application_server | — | — |
| ibm | websphere_application_server | — | — |
| ibm | websphere_application_server | — | — |
| ibm | websphere_application_server | — | — |
| ibm | websphere_application_server | — | — |
| ibm | websphere_application_server | — | — |
| ibm | websphere_application_server | — | — |
| ibm | websphere_application_server | — | — |
| ibm | websphere_application_server | — | — |
| ibm | websphere_application_server | — | — |
| ibm | websphere_application_server | — | — |
| ibm | websphere_application_server | — | — |
| ibm | websphere_application_server | — | — |
| ibm | websphere_application_server | — | — |
| ibm | websphere_application_server | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
IBM Websphere Application Server 7.0.0.13 - Cross-Site Request Forgery
exploitdb·2011-06-15·CVSS 6.8
CVE-2010-3271 [MEDIUM] IBM Websphere Application Server 7.0.0.13 - Cross-Site Request Forgery
IBM Websphere Application Server 7.0.0.13 - Cross-Site Request Forgery
---
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Core Security Technologies - CoreLabs Advisory
http://corelabs.coresecurity.com/
IBM WebSphere Application Server Cross-Site Request Forgery
1. *Advisory Information*
Title: IBM WebSphere Application Server Cross-Site Request Forgery
Advisory ID: CORE-2010-1021
Advisory URL: http://www.coresecurity.com/content/IBM-WebSphere-CSRF
Date published: 2011-06-15
Date of last update: 2011-06-15
Vendors contacted: IBM
Release mode: User release
2. *Vulnerability Information*
Class: Cross-Site Request Forgery (CSRF) [CWE-352]
Impact: Code execution
Remotely Exploitable: Yes
Locally Exploitable: No
CVE Name: CVE-2010-3271
3. *Vulnerability Description*
WebSphere is IBM
Exploit-DB
SoftBizScripts Dating Script - SQL Injection
exploitdb·2010-04-28
CVE-2006-3271 SoftBizScripts Dating Script - SQL Injection
SoftBizScripts Dating Script - SQL Injection
---
# Exploit Title: SoftBizScripts Dating Script SQL Injection Vunerability
# Date: 29-4-2010
# Author: 41.w4r10r
# Vendor Link : http://softbizscripts.com/
# Version: Web Application
# Tested on: Apcahe/Unix
# CVE : [if exists]
# Dork : inurl:"search_results.php?browse=1"
# Code :
############################################################################
#Greetz to all Andhra Hackers and ICW Memebers[Indian Cyber
Warriors]
#Thanks:
SaiSatish,FB1H2S,Godwin_Austin,Micr0,Harin,Jappy,Dark_Blue,sid3^3f3c7
#Shoutz: hg_H@x0r,r45c4l,Yash,Hackuin,unn4m3d
#Catch us at www.andhrahackers.com or www.teamicw.in
############################################################################
Exploited Link :
http://example.com/search_results.php?browse=1'
No writeups or analysis indexed.
http://securityreason.com/securityalert/8281http://www.coresecurity.com/content/IBM-WebSphere-CSRFhttp://www.exploit-db.com/exploits/17404http://www.securityfocus.com/archive/1/518465/100/0/threadedhttp://www.securityfocus.com/bid/48305http://securityreason.com/securityalert/8281http://www.coresecurity.com/content/IBM-WebSphere-CSRFhttp://www.exploit-db.com/exploits/17404http://www.securityfocus.com/archive/1/518465/100/0/threadedhttp://www.securityfocus.com/bid/48305
2011-07-18
Published