CVE-2020-14945

HIGH

Global RADAR BSA Radar <1.6.7234.24750 - Privilege Escalation

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2020-14945. PoCs published by William Summerhill.

AI-analyzed exploit summary This exploit demonstrates an authenticated privilege escalation vulnerability in BSA Radar 1.6.7234.24750 and lower. By forging a request to the SaveUser endpoint, a low-privileged user can escalate their role to BankAdmin.

Description

A privilege escalation vulnerability exists within Global RADAR BSA Radar 1.6.7234.24750 and earlier that allows an authenticated, low-privileged user to escalate their privileges to administrator rights (i.e., the BankAdmin role) via modified SaveUser data.

Exploits (1)

exploitdb WORKING POC

by William Summerhill · textwebappsmultiple

https://www.exploit-db.com/exploits/48649

View Code ZIP pw:eip

This exploit demonstrates an authenticated privilege escalation vulnerability in BSA Radar 1.6.7234.24750 and lower. By forging a request to the SaveUser endpoint, a low-privileged user can escalate their role to BankAdmin.

Classification

Working Poc 90%

Attack Type

Auth Bypass

Complexity

Trivial

Reliability

Reliable

Target: BSA Radar - Version 1.6.7234.24750 and lower

Auth required

Prerequisites: Authenticated access to the application · UserID and other user profile details

MITRE ATT&CK