CVE-2018-6888

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

An issue was discovered in Typesetter 5.1. The User Permissions page (aka Admin/Users) suffers from critical flaw of Cross Site Request forgery: using a forged HTTP request, a malicious user can lead a user to unknowingly create / delete or modify a user account due to the lack of an anti-CSRF token.

Metrics

CVSS 3.0 8.0/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://securitywarrior9.blogspot.in/2018/02/cross-site-request-forgery-type-setter.htmlExploit, Third Party Advisory
https://www.exploit-db.com/exploits/44029/Exploit, Third Party Advisory, VDB Entry
https://securitywarrior9.blogspot.in/2018/02/cross-site-request-forgery-type-setter.htmlExploit, Third Party Advisory
https://www.exploit-db.com/exploits/44029/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Feb 12, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-68898.8An issue was discovered in Typesetter 5.1. It suffers from a Host header injection vulnerability, Using this attack, a malicious user can po CVE-2018-68904.8Cross-site scripting (XSS) vulnerability in Wolf CMS 0.8.3.1 via the page editing feature, as demonstrated by /?/admin/page/edit/3.CVE-2018-68916.1Bookly #1 WordPress Booking Plugin Lite before 14.5 has XSS via a jQuery.ajax request to ng-payment_details_dialog.js.CVE-2018-68929.8An issue was discovered in CloudMe before 1.11.0. An unauthenticated remote attacker that can connect to the "CloudMe Sync" client applicati CVE-2018-68939.8controllers/member/Api.php in dayrui FineCms 5.2.0 has SQL Injection: a request with s=member,c=api,m=checktitle, and the parameter 'module'CVE-2018-69005.4PHP Scripts Mall Website Broker Script 3.0.6 has XSS via the Last Name field on the My Profile page.CVE-2018-69025.4PHP Scripts Mall Image Sharing Script 1.3.3 has XSS via the Full Name field in an Edit Profile action.CVE-2018-69038.8PHP Scripts Mall Hot Scripts Clone Script Classified v3.1 uses the client side to enforce validation of an e-mail address, which allows remo CVE-2018-69045.4PHP Scripts Mall Car Rental Script 2.0.8 has XSS via the User Name field in an Edit Profile action.CVE-2018-69054.8The page module in TYPO3 before 8.7.11, and 9.1.0, has XSS via $GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename'], as demonstrated by an admin e CVE-2018-69066.1A persistent Cross Site Scripting (XSS) vulnerability in the Green Electronics RainMachine Mini-8 (2nd Generation) and Touch HD 12 web appli CVE-2018-69078.8A Cross Site Request Forgery (CSRF) vulnerability in the Green Electronics RainMachine Mini-8 (2nd Generation) and Touch HD 12 web applicati