This host is running Zikula and is prone to cross-site request forgery vulnerability.

Successful exploitation will allow remote attackers to execute arbitrary commands in the context of affected site. Impact Level: Application.

Upgrade to the Zikula version 1.2.5 For updates refer to http://zikula.org/

The flaw exists because the application does not require multiple steps or explicit confirmation for sensitive transactions for majority of administrator functions such as adding new user, assigning user to administrative privilege.

Zikula version 1.2.4 and prior

• http://packetstormsecurity.org/files/view/98060/zikulacms-xsrf.txt
• http://securityreason.com/exploitalert/9921
• http://www.exploit-db.com/exploits/16097/

---

Updated on 2015-03-25