CVE-2018-25343
MEDIUMSmartshop 1 Cross-Site Request Forgery via editprofile.php
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2018-25343. PoCs published by L0RD.
AI-analyzed exploit summary This is a functional CSRF exploit targeting Smartshop 1's editprofile.php. It demonstrates how an attacker can change the admin password by tricking a victim into submitting a crafted form.
Description
Smartshop 1 contains a cross-site request forgery vulnerability that allows attackers to modify user profiles by tricking authenticated users into submitting malicious requests. Attackers can craft HTML forms targeting editprofile.php with hidden fields for email and password parameters that execute automatically when visited by an authenticated admin user.
Exploits (1)
This is a functional CSRF exploit targeting Smartshop 1's editprofile.php. It demonstrates how an attacker can change the admin password by tricking a victim into submitting a crafted form.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N