Test ID:	1.3.6.1.4.1.25623.1.0.106762
Category:	Web application abuses
Title:	Concrete5 Header Injection and CSRF Vulnerability
Summary:	Concrete5 CMS is prone to a header injection and CSRF vulnerability.
Description:	Summary: Concrete5 CMS is prone to a header injection and CSRF vulnerability. Vulnerability Insight: Multiple flaws exist because: - Concrete5 places incorrect trust in the HTTP Host header during caching, if the administrator did not define a 'canonical' URL on installation of Concrete5 using the 'Advanced Options' settings. Remote attackers can make a GET request with any domain name in the Host header. This is stored and allows for arbitrary domains to be set for certain links displayed to subsequent visitors, potentially an XSS vector. - Concrete5's Thumbnail Editor in the File Manager is vulnerable to CSRF, which allows remote attackers to disable the entire installation of Concrete5, by merely tricking an admin view a malicious page. This results in a site-wide denial of service meaning neither the admin OR any of the website users can access the site. Affected Software/OS: Concrete5 version 8.x. Solution: No known solution was made available for at least one year since the disclosure of this vulnerability. Likely none will be provided anymore. General solution options are to upgrade to a newer release, disable respective features, remove the product or replace the product by another one. CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2017-7725 BugTraq ID: 97649 http://www.securityfocus.com/bid/97649 https://www.exploit-db.com/exploits/41885/ http://hyp3rlinx.altervista.org/advisories/CONCRETE5-v8.1.0-HOST-HEADER-INJECTION.txt https://hackerone.com/reports/148300 https://packetstormsecurity.com/files/142145/concrete5-8.1.0-Host-Header-Injection.html Common Vulnerability Exposure (CVE) ID: CVE-2017-8082 http://zeroday.insecurity.zone/exploits/concrete5_csrf_dos.txt https://drive.google.com/open?id=0B3vXUYdNMECWZTd3SFRnUjllWk0 https://twitter.com/insecurity/status/856066923146215425
Copyright	Copyright (C) 2017 Greenbone Networks GmbH

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.