FKIE_CVE-2013-3729

Vulnerability from fkie_nvd - Published: 2014-03-13 14:55 - Updated: 2026-06-16 23:55
Severity
Summary
Multiple cross-site request forgery (CSRF) vulnerabilities in Kasseler CMS before 2 r1232 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the (1) groups[] parameter in a send action in the sendmail module or (2) query parameter in a sql_query action in the database module to admin.php, related to CVE-2013-3727.
References
cve@mitre.orghttp://diff.kasseler-cms.net/svn.html
cve@mitre.orghttp://diff.kasseler-cms.net/svn/patches/1232.htmlPatch, Vendor Advisory
cve@mitre.orghttp://osvdb.org/94781
cve@mitre.orghttp://packetstormsecurity.com/files/122282/Kasseler-CMS-2-r1223-CSRF-XSS-SQL-Injection.htmlExploit
cve@mitre.orghttp://seclists.org/bugtraq/2013/Jul/26Exploit
cve@mitre.orghttps://www.htbridge.com/advisory/HTB23158Exploit
af854a3a-2127-422b-91ae-364da2661108http://diff.kasseler-cms.net/svn.html
af854a3a-2127-422b-91ae-364da2661108http://diff.kasseler-cms.net/svn/patches/1232.htmlPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/94781
af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/122282/Kasseler-CMS-2-r1223-CSRF-XSS-SQL-Injection.htmlExploit
af854a3a-2127-422b-91ae-364da2661108http://seclists.org/bugtraq/2013/Jul/26Exploit
af854a3a-2127-422b-91ae-364da2661108https://www.htbridge.com/advisory/HTB23158Exploit
Impacted products
Vendor Product Version
kasseler-cms kasseler-cms *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:kasseler-cms:kasseler-cms:*:r1223:*:*:*:*:*:*",
              "matchCriteriaId": "81E9FD7E-CADD-4D0A-9670-85C3A248C5C2",
              "versionEndIncluding": "2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in Kasseler CMS before 2 r1232 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the (1) groups[] parameter in a send action in the sendmail module or (2) query parameter in a sql_query action in the database module to admin.php, related to CVE-2013-3727."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples vulnerabilidades de CSRF en Kasseler CMS anterior a 2 r1232 permiten a atacantes remotos secuestrar la autenticaci\u00f3n de administradores para solicitudes que realizan ataques de inyecci\u00f3n SQL a trav\u00e9s de (1) el par\u00e1metro groups[] en una acci\u00f3n \"send\" en el m\u00f3dulo sendmail o (2) el par\u00e1metro query en una acci\u00f3n sql_query en el m\u00f3dulo de base de datos hacia admin.php, relacionado con CVE-2013-3727."
    }
  ],
  "id": "CVE-2013-3729",
  "lastModified": "2026-06-16T23:55:41.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2014-03-13T14:55:05.127",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://diff.kasseler-cms.net/svn.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://diff.kasseler-cms.net/svn/patches/1232.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/94781"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://packetstormsecurity.com/files/122282/Kasseler-CMS-2-r1223-CSRF-XSS-SQL-Injection.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://seclists.org/bugtraq/2013/Jul/26"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "https://www.htbridge.com/advisory/HTB23158"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://diff.kasseler-cms.net/svn.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://diff.kasseler-cms.net/svn/patches/1232.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/94781"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://packetstormsecurity.com/files/122282/Kasseler-CMS-2-r1223-CSRF-XSS-SQL-Injection.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://seclists.org/bugtraq/2013/Jul/26"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "https://www.htbridge.com/advisory/HTB23158"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.