CVE-2024-0880

Name of the Vulnerable Software and Affected Versions Qidianbang qdbcrm version 1.1.0

Description A vulnerability was found in the Password Reset component of Qidianbang qdbcrm, affecting some unknown functionality of the file /user/edit?id=2. This issue leads to cross-site request forgery and can be exploited remotely. The exploit has been disclosed to the public.

Recommendations For Qidianbang qdbcrm version 1.1.0, as a temporary workaround, consider restricting access to the /user/edit?id=2 endpoint of the Password Reset component until a patch is available. Additionally, avoid using the id parameter in the affected endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.