SB2024022737 - Multiple vulnerabilities in flusity CMS

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Cross-site request forgery (CVE-ID: CVE-2024-26352)

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin. in the component /core/tools/add_places.php A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.

2) Cross-site request forgery (CVE-ID: CVE-2024-26351)

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin in the component /core/tools/update_place.php. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.

3) Cross-site request forgery (CVE-ID: CVE-2024-26349)

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin in the component /core/tools/delete_translation.php. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.

4) Cross-site request forgery (CVE-ID: CVE-2024-26350)

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin in the component /core/tools/update_contact_form_settings.php. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.

Remediation

Install update from vendor's website.

References

• https://github.com/Icycu123/cms/blob/main/3.md
• https://github.com/Icycu123/cms/blob/main/4.md
• https://github.com/Icycu123/cms/blob/main/1.md
• https://github.com/Icycu123/cms/blob/main/2.md