Anchor CMS 0.12.7 - Cross-Site Request Forgery in User Edit Function
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2020-23342. PoCs published by Ninad Mishra, DXY0411.
AI-analyzed exploit summary This exploit demonstrates a CSRF vulnerability in Anchor CMS 0.12.7, allowing an attacker to delete a user by tricking an admin into clicking a malicious link. The exploit uses a simple GET request to delete a user with a specified ID.
Description
A CSRF vulnerability exists in Anchor CMS 0.12.7 anchor/views/users/edit.php that can change the Delete admin users.
Exploits (2)
This exploit demonstrates a CSRF vulnerability in Anchor CMS 0.12.7, allowing an attacker to delete a user by tricking an admin into clicking a malicious link. The exploit uses a simple GET request to delete a user with a specified ID.
This repository contains a proof-of-concept exploit for CVE-2020-23342, targeting Anchor CMS. The exploit leverages a command injection vulnerability in the `composer_check.php` file, where the `exec` function is used unsafely to run `composer install`.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H