vendor:
Status2k
by:
alnjm33
N/A
CVSS
N/A
Remote Add Admin Exploit
N/A
CWE
Product Name: Status2k
Affected Version From: Version 1
Affected Version To: Version 1
Patch Exists: N/A
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Version 1
N/A
status2k Remote Add Admin Exploit
This exploit allows an attacker to add an admin user to the Status2k application. The attacker can use the Dork (allinurl:dynamicimg.php) to find vulnerable sites and then use the HTML form to add an admin user with the username and password of 'sec-war'.
Mitigation:
The best way to mitigate this vulnerability is to ensure that the application is properly configured and that all users have strong passwords.
