PT-2018-9805
CVE-2018-10295
·
Published
2018-04-22
·
Updated
2018-05-25
Description by
CVSS 3.1
8.8
HighMetricsAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions:
ChemCMS version 1.0.6
Description:
The issue allows for CSRF by utilizing the "public/admin/user/addpost.html" endpoint to add an administrator account.
Recommendations:
For ChemCMS version 1.0.6, consider implementing proper CSRF protection mechanisms to prevent unauthorized actions, such as adding administrator accounts through the "public/admin/user/addpost.html" endpoint. As a temporary workaround, restrict access to this endpoint until a proper fix is applied.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾