CVE-2012-1220
GAzie < 5.20 - Cross-Site Request Forgery via Admin User Update Action
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2012-1220. PoCs published by Giuseppe D'Inverno.
AI-analyzed exploit summary This is a CSRF exploit for GAzie <= 5.20 that allows an attacker to trick an authenticated administrator into submitting a malicious form to update user details, potentially leading to privilege escalation or account takeover.
Description
Cross-site request forgery (CSRF) vulnerability in modules/config/admin_utente.php in GAzie 5.20 and earlier allows remote attackers to hijack the authentication of administrators for requests that change account information via an update action, as demonstrated by changing the password.
Exploits (1)
This is a CSRF exploit for GAzie <= 5.20 that allows an attacker to trick an authenticated administrator into submitting a malicious form to update user details, potentially leading to privilege escalation or account takeover.