A cross-site request forgery (CSRF) vulnerability in mod/user/act_user.php in Garfield Petshop through 2020-10-01 allows remote attackers to hijack the authentication of administrators for requests that create new administrative accounts.
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/159520/Garfield-Petshop-2020-10-01-Cross-Site-Request-Forgery.html | Third Party Advisory |
| http://rysec.io/adv/Petshop_AddAdmin_Exploit.txt | Exploit Third Party Advisory URL Repurposed |
| https://demo.detapos.co.id/petshop/ | Permissions Required Third Party Advisory |
| https://detapos.co/ | Third Party Advisory |
| http://packetstormsecurity.com/files/159520/Garfield-Petshop-2020-10-01-Cross-Site-Request-Forgery.html | Third Party Advisory |
| http://rysec.io/adv/Petshop_AddAdmin_Exploit.txt | Exploit Third Party Advisory URL Repurposed |
| https://demo.detapos.co.id/petshop/ | Permissions Required Third Party Advisory |
| https://detapos.co/ | Third Party Advisory |
Configurations
History
21 Nov 2024, 05:20
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://packetstormsecurity.com/files/159520/Garfield-Petshop-2020-10-01-Cross-Site-Request-Forgery.html - Third Party Advisory | |
| References | () http://rysec.io/adv/Petshop_AddAdmin_Exploit.txt - Exploit, Third Party Advisory, URL Repurposed | |
| References | () https://demo.detapos.co.id/petshop/ - Permissions Required, Third Party Advisory | |
| References | () https://detapos.co/ - Third Party Advisory |
14 Feb 2024, 01:17
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) http://rysec.io/adv/Petshop_AddAdmin_Exploit.txt - Exploit, Third Party Advisory, URL Repurposed |
Information
Published : 2020-10-09 07:15
Updated : 2024-11-21 05:20
NVD link : CVE-2020-26522
Mitre link : CVE-2020-26522
CVE.ORG link : CVE-2020-26522
JSON object : View
Products Affected
garfield_petshop_project
- garfield_petshop
CWE
CWE-352
Cross-Site Request Forgery (CSRF)