The exploit demonstrates multiple CSRF vulnerabilities in FTGate v7, allowing actions such as adding arbitrary domains, enabling remote log archiving, whitelisting email addresses, and disabling antivirus checks. It includes functional HTML/JavaScript PoC code to trigger these actions via crafted POST requests.
Classification
Working Poc 95%
Target:
FTGate v7
No auth needed
Prerequisites:
Victim must visit a malicious webpage while authenticated to the FTGate v7 admin interface