Easy2Pilot 7 Cross-Site Request Forgery via admin.php
Vulnerability Description
Easy2Pilot 7 contains a cross-site request forgery vulnerability that allows attackers to add unauthorized user accounts by tricking authenticated administrators into visiting malicious pages. Attackers can craft HTML forms targeting the admin.php?action=add_user endpoint with POST requests containing username and password parameters to create new administrative accounts without explicit user consent.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-37217
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- indoushka
Affected Vendor
Easy2Pilot
View all reports →