CVE-2020-7991
HIGHAdive Framework 2.0.8 - Cross-Site Request Forgery in Admin Config
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2020-7991. PoCs published by Sarthak Saini.
AI-analyzed exploit summary This exploit demonstrates a Cross-Site Request Forgery (CSRF) vulnerability in Adive Framework 2.0.8, allowing an attacker to change the admin password via a stored XSS payload. The PoC includes a JavaScript payload that triggers a password change request when executed in the context of an admin session.
Description
Adive Framework 2.0.8 has admin/config CSRF to change the Administrator password.
Exploits (2)
This exploit demonstrates a Cross-Site Request Forgery (CSRF) vulnerability in Adive Framework 2.0.8, allowing an attacker to change the admin password via a stored XSS payload. The PoC includes a JavaScript payload that triggers a password change request when executed in the context of an admin session.
The exploit demonstrates a persistent XSS vulnerability in Adive Framework 2.0.8 via the 'userUsername' parameter, followed by a CSRF attack to change the admin password. The PoC includes HTTP requests and JavaScript payloads to trigger the attack.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H