CVE-2011-5074
Support Incident Tracker < 3.65 - Cross-Site Request Forgery via User Profile Edit
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2011-5074. PoCs published by High-Tech Bridge SA.
AI-analyzed exploit summary The exploit demonstrates multiple SQL injection and XSS vulnerabilities in SiT! Support Incident Tracker. It includes PoC URLs and forms for exploiting unsanitized input parameters.
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in Support Incident Tracker (aka SiT!) before 3.65 allow remote attackers to hijack the authentication of administrators for requests that change administrator email, add a new administrator, or insert arbitrary script via (1) user_profile_edit.php or (2) user_add.php.
Exploits (1)
The exploit demonstrates multiple SQL injection and XSS vulnerabilities in SiT! Support Incident Tracker. It includes PoC URLs and forms for exploiting unsanitized input parameters.