Exploitation Summary
EIP tracks 1 public exploit for CVE-2018-25150. PoCs published by LiquidWorm.
AI-analyzed exploit summary This HTML-based PoC demonstrates a CSRF vulnerability in Ecessa ShieldLink SL175EHQ, allowing an attacker to add a superuser account via a malicious form submission. The exploit targets the `/cgi-bin/pl_web.cgi/util_configlogin_act` endpoint without requiring valid CSRF tokens.
Description
Ecessa ShieldLink SL175EHQ 10.7.4 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts without authentication. Attackers can craft a malicious web page with a hidden form to add a superuser account by tricking a logged-in administrator into loading the page.
Exploits (1)
This HTML-based PoC demonstrates a CSRF vulnerability in Ecessa ShieldLink SL175EHQ, allowing an attacker to add a superuser account via a malicious form submission. The exploit targets the `/cgi-bin/pl_web.cgi/util_configlogin_act` endpoint without requiring valid CSRF tokens.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N