CVE-2018-11538

ALTO 8.8CVE-2018-11538 · Published 01/06/2018 · updated 17/06/2026

Package	Affected versions	Patched versions
searchblox searchblox	`= 8.6.6`	No fix yet

Description

servlet/UserServlet in SearchBlox 8.6.6 has CSRF via the u_name, u_passwd1, u_passwd2, role, and X-XSRF-TOKEN POST parameters because of CSRF Token Bypass.

References

packetstormsecurity.com/files/147977/SearchBlox-8.6.6-Cross-Site-Request-Forgery.html · Exploit
gurelahmet.com/cve-2018-11538-csrf-privilege-escalation-creation-of-an-administrator-account-on-searchblox-8-6-6 · Exploit
exploit-db.com/exploits/44801 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free