Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

NoneCMS 1.3.0 lets attackers change admin passwords

CVE-2018-7219 · published 8 years ago
Summary

The admin management page in NoneCMS version 1.3.0 does not verify that requests come from a legitimate user, so anyone who can reach the edit page can change the administrator’s password or create new accounts. This could give unauthorized users full control of the site. Apply the vendor’s security update or restrict access to the admin functions until the fix is installed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
5none nonecms 1.3.0
cpe:2.3:a:5none:nonecms:1.3.0:*:*:*:*:*:*:*
Original advisory text
application/admin/controller/Admin.php in NoneCms 1.3.0 has CSRF, as demonstrated by changing an admin password or adding an account via a public/index.php/admin/admin/edit.html request.
application/admin/controller/Admin.php in NoneCms 1.3.0 has CSRF, as demonstrated by changing an admin password or adding an account via a public/index.php/admin/admin/edit.html request.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published19 Feb 2018
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-7219 · NVD
Track software like this
Free during beta