A vulnerability has been discovered in SkyBlueCanvas, which can be exploited by malicious people to conduct cross-site request forgery attacks.

The application allows users to perform certain actions via HTTP requests without performing proper checks to verify the requests. This can be exploited to e.g. change a user's password or delete messages in the administrative interface by tricking a logged-in user into visiting a malicious website.

The vulnerability is confirmed in version 1.1-r248. Other versions may also be affected.

Solution
Do not browse untrusted websites or follow untrusted links while being logged-in to the application.

Provided and/or discovered by
Independently discovered by:
* Russ McRee, reported via Secunia
* Sweet

Original Advisory
HIO-2010-0921:
http://holisticinfosec.org/content/view/155/45/

Deep Links
Links available in Customer Area