CWE Code: 352
Vulnerability Type: privilege_escalation
CVSS Score: 6.8
CWE Name:  Cross-Site Request Forgery (CSRF)
Summary: multiple cross-site request forgery (csrf) vulnerabilities in mainfile.php in francisco burzi php-nuke 8.0 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add user accounts or (2) grant the administrative privilege to a user account, related to a referer check that uses a substring comparison.
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2011-06-21
Last Modified Date: 2018-08-13