CVE-2017-11567

Cross-site request forgery (CSRF) vulnerability in Mongoose Web Server before 6.9 allows remote attackers to hijack the authentication of users for requests that modify Mongoose.conf via a request to __mg_admin?save. NOTE: this issue can be leveraged to execute arbitrary code remotely.

• CWE-352

• http://hyp3rlinx.altervista.org/advisories/MONGOOSE-WEB-SERVER-v6.5-CSRF-COMMAND-EXECUTION.txtExploit
• http://seclists.org/fulldisclosure/2017/Sep/3Exploit, Mailing List, Third Party Advisory
• https://www.exploit-db.com/exploits/42614/Exploit, Third Party Advisory, VDB Entry
• http://hyp3rlinx.altervista.org/advisories/MONGOOSE-WEB-SERVER-v6.5-CSRF-COMMAND-EXECUTION.txtExploit
• http://seclists.org/fulldisclosure/2017/Sep/3Exploit, Mailing List, Third Party Advisory
• https://www.exploit-db.com/exploits/42614/Exploit, Third Party Advisory, VDB Entry

Published

Sep 7, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-11561An issue was discovered in ZOHO ManageEngine OpManager 12.2.…
• CVE-2017-11562A Session Fixation Vulnerability exists in the MT4 Networks …
• CVE-2017-11563D-Link EyeOn Baby Monitor (DCS-825L) 1.08.1 has a remote cod…
• CVE-2017-11564The D-Link EyeOn Baby Monitor (DCS-825L) 1.08.1 has multiple…
• CVE-2017-11565debian/tor.init in the Debian tor_0.2.9.11-1~deb9u1 package …
• CVE-2017-11566AppUse 4.0 allows shell command injection via a proxy field.7.8
• CVE-2017-11568FontForge 20161012 is vulnerable to a heap-based buffer over…
• CVE-2017-11569FontForge 20161012 is vulnerable to a heap-based buffer over…
• CVE-2017-1157IBM Jazz Reporting Service (JRS) 5.0 and 6.0 could allow an …
• CVE-2017-11570FontForge 20161012 is vulnerable to a buffer over-read in um…
• CVE-2017-11571FontForge 20161012 is vulnerable to a stack-based buffer ove…
• CVE-2017-11572FontForge 20161012 is vulnerable to a heap-based buffer over…