Description
Vvveb through 1.0.8.6 contains a cross-site request forgery vulnerability that allows attackers to perform admin state-changing actions because checkCsrf() in admin/controller/base.php only validates tokens for POST requests. Attackers can lure a logged-in admin into loading a forged cross-site GET request to delete admin/user accounts, sites, orders, and menus or change comment status.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| givanz | Vvveb | ≤ 1.0.8.6 | — |
References
- GitHub Security Advisory (GHSA-grxp-rj92-j8xr) vendor-advisory
- VulnCheck Advisory: Vvveb through 1.0.8.6 CSRF via GET Admin State-Changing Actions third-party-advisory