CVE-2020-13155

Name of the Vulnerable Software and Affected Versions NukeViet version 4.4

Description The issue allows for CSRF with resultant HTML injection via the deltype parameter to the "admin/index.php?nv=webtools&op=clearsystem" URI. This can be exploited through the clearsystem.php file.

Recommendations For NukeViet version 4.4, consider disabling the clearsystem.php file or restricting access to the "admin/index.php?nv=webtools&op=clearsystem" URI until a patch is available. Avoid using the deltype parameter in the affected URI to minimize the risk of exploitation.