vendor:
Planet
by:
G0D-F4Th3r
8,8
CVSS
HIGH
Cross-Site Request Forgery (CSRF)
352
CWE
Product Name: Planet
Affected Version From: 1.1
Affected Version To: 1.1
Patch Exists: NO
Related CWE: N/A
CPE: a:femtolayer:planet:1.1
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: None
2010
Planet 1.1 – [CSRF] Add Admin Account
This exploit allows an attacker to add an admin account to the Planet 1.1 software. The attacker can craft a malicious HTML page with a form containing the username, password, email, mobile, site, location, and access values. When the victim visits the malicious page, the form is automatically submitted and the attacker's account is created.
Mitigation:
Implementing CSRF protection tokens, using same-site cookies, and using a Content Security Policy (CSP) are some of the ways to mitigate CSRF attacks.
