CVE-2020-26522

HIGH

Garfield Petshop < 2020-10-01 - Cross-Site Request Forgery in User Management

Title source: llm
STIX 2.1

Description

A cross-site request forgery (CSRF) vulnerability in mod/user/act_user.php in Garfield Petshop through 2020-10-01 allows remote attackers to hijack the authentication of administrators for requests that create new administrative accounts.

References (4)

Core 4
Core References
Third Party Advisory x_refsource_misc
https://detapos.co/
Permissions Required, Third Party Advisory x_refsource_misc
https://demo.detapos.co.id/petshop/
Exploit, Third Party Advisory, URL Repurposed x_refsource_misc
http://rysec.io/adv/Petshop_AddAdmin_Exploit.txt

Scores

CVSS v3 8.8
EPSS 0.0077
EPSS Percentile 51.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-352
Status published
Products (1)
garfield_petshop_project/garfield_petshop < 2020-10-01
Published Oct 09, 2020
Tracked Since Feb 18, 2026