CVE-2018-11004

HIGH

SDcms 1.5 - Cross-Site Request Forgery in Admin Controller

Title source: llm

Description

An issue was discovered in SDcms v1.5. Cross-site request forgery (CSRF) vulnerability in /WWW//app/admin/controller/admincontroller.php allows remote attackers to add administrator accounts via m=admin&c=admin&a=add.

References (1)

Core 1

Core References

Exploit, Third Party Advisory x_refsource_misc

https://github.com/TekerFue/SDcms-Code-Audit/blob/master/1.5%20csrf

Scores

CVSS v3 8.8

EPSS 0.0058

EPSS Percentile 43.5%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-352

Status published

Products (1)

sdcms/sdcms 1.5

Published May 12, 2018

Tracked Since Feb 18, 2026