Exploitation Summary
EIP tracks 1 public exploit for CVE-2019-25447. PoCs published by Ozer Goker.
AI-analyzed exploit summary The exploit demonstrates multiple CSRF and XSS vulnerabilities in OrientDB 3.0.17 GA Community Edition. It includes detailed HTTP requests for actions like creating/deleting databases, managing users, and executing stored/reflected XSS payloads.
Description
OrientDB 3.0.17 GA Community Edition contains cross-site request forgery vulnerabilities that allow attackers to perform unauthorized actions by crafting malicious requests to endpoints like /database/, /command/, and /document/. Attackers can create or delete databases, modify schema classes, manage users, and create functions by sending authenticated requests without token validation, combined with reflected and stored cross-site scripting vulnerabilities in the web interface.
Exploits (1)
The exploit demonstrates multiple CSRF and XSS vulnerabilities in OrientDB 3.0.17 GA Community Edition. It includes detailed HTTP requests for actions like creating/deleting databases, managing users, and executing stored/reflected XSS payloads.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N