Exploitation Summary
EIP tracks 1 public exploit for CVE-2020-10229. PoCs published by Marco Ruela.
AI-analyzed exploit summary This exploit chains XSS, file upload, and CSRF vulnerabilities in VTENEXT 19 CE to achieve remote code execution. It sends a malicious email with an XSS payload that triggers a file upload of a PHP shell, then locates and executes commands on the uploaded shell.
Description
A CSRF issue in vtecrm vtenext 19 CE allows attackers to carry out unwanted actions on an administrator's behalf, such as uploading files, adding users, and deleting accounts.
Exploits (1)
This exploit chains XSS, file upload, and CSRF vulnerabilities in VTENEXT 19 CE to achieve remote code execution. It sends a malicious email with an XSS payload that triggers a file upload of a PHP shell, then locates and executes commands on the uploaded shell.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H