Description (CNA)
Easy2Pilot 7 contains a cross-site request forgery vulnerability that allows attackers to add unauthorized user accounts by tricking authenticated administrators into visiting malicious pages. Attackers can craft HTML forms targeting the admin.php?action=add_user endpoint with POST requests containing username and password parameters to create new administrative accounts without explicit user consent.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Easy2Pilot / Easy2Pilot | affected 7 |
CWE
CWE-352
References
- https://www.exploit-db.com/exploits/48099
- http://easy2pilot-v7.com/
- https://www.vulncheck.com/advisories/easy2pilot-7-cross-site-request-forgery-via-admin-php
ADP enrichment
No English description supplied.
No references supplied.