Exploitation Summary
EIP tracks 2 public exploits for CVE-2024-56898. PoCs published by Giorgi Dograshvili, DRAGOWN.
AI-analyzed exploit summary The exploit demonstrates a broken access control vulnerability in GeoVision GV-ASManager, allowing low-privilege users to escalate privileges by creating or modifying accounts via a crafted POST request to the ASWebCommon.srf endpoint.
Description
Broken access control vulnerability in Geovision GV-ASWeb with version v6.1.0.0 or less. This vulnerability allows low privilege users perform actions that they aren't authorized to, which can be leveraged to escalate privileges, create, modify or delete accounts.
Exploits (2)
The exploit demonstrates a broken access control vulnerability in GeoVision GV-ASManager, allowing low-privilege users to escalate privileges by creating or modifying accounts via a crafted POST request to the ASWebCommon.srf endpoint.
This repository documents CVE-2024-56898, a broken access control vulnerability in Geovision GV-ASManager v6.1.0.0 or lower, allowing low-privilege users (e.g., Guest) to escalate privileges, create/modify accounts, and perform unauthorized actions. The writeup includes detailed steps and screenshots demonstrating the exploit.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H