vendor:
Pc4Uploader
by:
RENO
8,8
CVSS
HIGH
Cross-Site Request Forgery (XSRF)
352
CWE
Product Name: Pc4Uploader
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2010
pc4uploader [XSRF] Add Admin Exploit
This exploit allows an attacker to add an admin account to the Pc4Uploader software. The attacker can set the username, password, and email address of the new admin account. The attacker can also set the permissions of the new admin account, such as setting the account to have full access to the software.
Mitigation:
The software should implement a CSRF protection mechanism, such as using a CSRF token, to prevent unauthorized requests.
