nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2020-37145 CVE-2020-37145
MEDIUM
HRSALE 1.1.8 - Cross-Site Request Forgery (Add Admin)
Record summary
CVE-2020-37145 has a selected CVSS score of 5.1 (medium); EIP currently links 1 catalogued exploit.
Description
HRSALE 1.1.8 contains a cross-site request forgery vulnerability that allows attackers to add unauthorized administrative users through the employee registration form. Attackers can craft a malicious HTML page with hidden form fields to trick authenticated administrators into creating new user accounts with elevated privileges.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 5, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
HRSALEBrowse HRSALE / HRSALE | CVE List | 1.1.8 | affected |
Proofs of concept
1Catalogued exploits
ExploitDBHRSALE 1.1.8 - Cross-Site Request Forgery (Add Admin)ExploitDB exploitby Ismail AkıcıNot analyzed1 file
References
4Archived Product Webpageproduct
https://web.archive.org/web/20200109113640/http://hrsale.com ExploitDB-48205exploit
https://www.exploit-db.com/exploits/48205 VulnCheck Advisory: HRSALE 1.1.8 - Cross-Site Request Forgery (Add Admin)Third-party advisory
https://www.vulncheck.com/advisories/hrsale-cross-site-request-forgery-add-admin