CVE-2019-13949
HIGHSyGuestBook A5 1.2 - Cross-Site Request Forgery via Password Change
Title source: llmDescription
SyGuestBook A5 Version 1.2 has no CSRF protection mechanism, as demonstrated by CSRF for an index.php?c=Administrator&a=update admin password change.
References (2)
Core 2
Core References
Exploit, Third Party Advisory x_refsource_misc
https://fragrant10.github.io/2019/02/22/SyGuestBookA5%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1.html
Exploit, Third Party Advisory x_refsource_misc
https://github.com/fragrant10/fragrant10.github.io/blob/master/_posts/2019-02-22-SyGuestBookA5%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1.md
Scores
CVSS v3
8.8
EPSS
0.0067
EPSS Percentile
47.5%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Details
CWE
CWE-352
Status
published
Products (1)
syguestbook_a5_project/syguestbook_a5
1.2
Published
Jul 18, 2019
Tracked Since
Feb 18, 2026