CVE-2020-13155: NukeViet Cross-Site Request Forgery (CSRF)
Summary
CVE-2020-13155: NukeViet Cross-Site Request Forgery (CSRF). Affects nukeviet/nukeviet versions 4.4.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NukeViet is a package available on Packagist that provides a content management system (CMS) for building websites. It offers various features and functionalities for website management. However, a vulnerability has been identified in NukeViet 4.4 that allows for Cross-Site Request Forgery (CSRF) attacks. This vulnerability can be exploited through the 'clearsystem.php' file, specifically the 'deltype' parameter in the 'admin/index.php?nv=webtools&op=clearsystem' URI.
Vulnerability Detail
The CSRF vulnerability in NukeViet 4.4 enables an attacker to perform unauthorized actions on behalf of a victim user. By tricking the victim into visiting a malicious website or clicking on a crafted link, the attacker can execute arbitrary actions within the NukeViet CMS. This can lead to various malicious activities, including HTML injection, which can further compromise the system and potentially impact the confidentiality, integrity, and availability of the website and its data.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, no specific workaround has been provided for this vulnerability. It is advised to apply the official patch or update as soon as it becomes available.
Conclusion
The CSRF vulnerability in NukeViet 4.4 poses a significant risk to the security of websites built using this CMS. It is essential for users to apply the official patch or update as soon as it becomes available to prevent unauthorized actions and potential compromise. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nukeviet/nukeviet →
FAQ
NukeViet is a content management system (CMS) that allows users to build and manage websites.
Cross-Site Request Forgery (CSRF) is an attack that tricks the victim into performing unwanted actions on a web application in which they are authenticated.
This vulnerability can be exploited by tricking a user into visiting a malicious website or clicking on a crafted link, which then performs unauthorized actions within the NukeViet CMS.
The CSRF vulnerability in NukeViet can lead to various malicious activities, including HTML injection, which can compromise the system's security and impact the confidentiality, integrity, and availability of the website and its data.
To protect your NukeViet installation, it is crucial to apply the latest patch or update provided by the NukeViet project. Additionally, practicing safe browsing habits and being cautious of clicking on unknown or suspicious links can help mitigate the risk of CSRF attacks.
Related vulnerabilities
Recent vulnerabilities recorded for nukeviet/nukeviet.
