CVE-2017-7447

HIGH

HelpDEZk 1.1.1 - Cross-Site Request Forgery in Logo Upload

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2017-7447. PoCs published by rungga_reksya.

AI-analyzed exploit summary This exploit demonstrates a CSRF vulnerability in HelpDEZK 1.1.1 that allows an attacker to create an admin account and upload malicious PHP files via unrestricted file upload in the logos module, leading to remote code execution.

Description

HelpDEZk 1.1.1 has CSRF in admin/home#/logos/ with an impact of remote execution of arbitrary PHP code.

Exploits (1)

exploitdb WORKING POC
by rungga_reksya · textwebappsphp
https://www.exploit-db.com/exploits/41824

This exploit demonstrates a CSRF vulnerability in HelpDEZK 1.1.1 that allows an attacker to create an admin account and upload malicious PHP files via unrestricted file upload in the logos module, leading to remote code execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: HelpDEZK 1.1.1
No auth needed
Prerequisites: Victim must be authenticated as an admin or tricked into executing the CSRF attack · Network access to the target application
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Patch, Third Party Advisory x_refsource_misc
https://github.com/albandes/helpdezk/issues/2
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/41824/
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/97485
Exploit, Technical Description, Third Party Advisory x_refsource_misc
http://rungga.blogspot.co.id/2017/04/multiple-csrf-remote-code-execution.html

Scores

CVSS v3 8.8
EPSS 0.0349
EPSS Percentile 87.6%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-352
Status published
Products (1)
helpdezk/helpdezk 1.1.1
Published Apr 05, 2017
Tracked Since Feb 18, 2026