CVE-2013-3729
published 2014-03-13CVE-2013-3729: Multiple cross-site request forgery (CSRF) vulnerabilities in Kasseler CMS before 2 r1232 allow remote attackers to hijack the authentication of administrators…
PriorityP334medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EXPLOIT
EPSS
1.25%
65.6th percentile
Multiple cross-site request forgery (CSRF) vulnerabilities in Kasseler CMS before 2 r1232 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the (1) groups[] parameter in a send action in the sendmail module or (2) query parameter in a sql_query action in the database module to admin.php, related to CVE-2013-3727.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| kasseler-cms | kasseler-cms | <= 2 | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Kasseler-cms 2 admin.php Query cross-site request forgery (Patch 122282 / EDB-26623)
vuldb·2026-05-07·CVSS 6.8
CVE-2013-3729 [MEDIUM] Kasseler-cms 2 admin.php Query cross-site request forgery (Patch 122282 / EDB-26623)
A vulnerability classified as problematic was found in Kasseler-cms 2. The impacted element is an unknown function of the file admin.php. The manipulation of the argument Query results in cross-site request forgery.
This vulnerability is reported as CVE-2013-3729. The attack can be launched remotely. Moreover, an exploit is present.
Upgrading the affected component is advised.
GHSA
GHSA-2x7x-45v7-xmvx: Multiple cross-site request forgery (CSRF) vulnerabilities in Kasseler CMS before 2 r1232 allow remote attackers to hijack the authentication of admin
ghsa_unreviewed·2022-05-17·CVSS 7.5
CVE-2013-3729 [HIGH] CWE-352 GHSA-2x7x-45v7-xmvx: Multiple cross-site request forgery (CSRF) vulnerabilities in Kasseler CMS before 2 r1232 allow remote attackers to hijack the authentication of admin
Multiple cross-site request forgery (CSRF) vulnerabilities in Kasseler CMS before 2 r1232 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the (1) groups[] parameter in a send action in the sendmail module or (2) query parameter in a sql_query action in the database module to admin.php, related to CVE-2013-3727.
No detection rules found.
No writeups or analysis indexed.
http://diff.kasseler-cms.net/svn.htmlhttp://diff.kasseler-cms.net/svn/patches/1232.htmlhttp://osvdb.org/94781http://packetstormsecurity.com/files/122282/Kasseler-CMS-2-r1223-CSRF-XSS-SQL-Injection.htmlhttp://seclists.org/bugtraq/2013/Jul/26https://www.htbridge.com/advisory/HTB23158http://diff.kasseler-cms.net/svn.htmlhttp://diff.kasseler-cms.net/svn/patches/1232.htmlhttp://osvdb.org/94781http://packetstormsecurity.com/files/122282/Kasseler-CMS-2-r1223-CSRF-XSS-SQL-Injection.htmlhttp://seclists.org/bugtraq/2013/Jul/26https://www.htbridge.com/advisory/HTB23158
2014-03-13
Published