CVEs-PoC/2015/CVE-2015-8379.md

CVE-2015-8379

Description

CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter.

POC

Reference

• http://blog.mindedsecurity.com/2016/01/request-parameter-method-may-lead-to.html
• http://blog.mindedsecurity.com/2016/01/request-parameter-method-may-lead-to.html
• http://packetstormsecurity.com/files/135301/CakePHP-3.2.0-CSRF-Bypass.html
• http://packetstormsecurity.com/files/135301/CakePHP-3.2.0-CSRF-Bypass.html

Github

No PoCs found on GitHub currently.