CVE-2016-20051
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Snews CMS 1.7 contains a cross-site request forgery vulnerability that allows attackers to change administrator credentials without authentication by crafting malicious HTML forms. Attackers can trick authenticated administrators into visiting a page containing a hidden form that submits POST requests to the changeup action, modifying the admin username and password parameters to gain unauthorized access.
Risk Assessment
The risk involves potential takeover of the administrator account by an attacker, which can lead to full compromise of the CMS system, including content modification, data theft, or further attacks on users.
Recommendation
It is recommended to immediately update Snews CMS to the latest available version that fixes this vulnerability and implement CSRF protection mechanisms such as anti-CSRF tokens in forms.
Original NVD description (English source)
Snews CMS 1.7 contains a cross-site request forgery vulnerability that allows attackers to change administrator credentials without authentication by crafting malicious HTML forms. Attackers can trick authenticated administrators into visiting a page containing a hidden form that submits POST requests to the changeup action, modifying the admin username and password parameters to gain unauthorized access.