PT-2019-13626 · Unknown · Schben Adive

Pablo Santiago · Published 2019-08-06 · Updated 2023-03-03 · CVE-2019-14347

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Schben Adive version 2.0.7

Description The issue allows remote unprivileged users, such as editors or developers, to create an administrator account. This can be achieved via the admin/user/add endpoint, as demonstrated by a Python proof-of-concept script.

Recommendations For Schben Adive version 2.0.7, consider restricting access to the admin/user/add endpoint until a patch is available. As a temporary workaround, limit the ability of unprivileged users to create new administrator accounts. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-425

Related Identifiers

CVE-2019-14347

Affected Products

Schben Adive

References · 7

• 🔥 https://exploit-db.com/exploits/47600 · Exploit
• 🔥 https://hackpuntes.com/cve-2019-14347-escalacion-de-privilegios-en-adive · Exploit
• 🔥 http://packetstormsecurity.com/files/155213/Adive-Framework-2.0.7-Privilege-Escalation.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-14347 · Security Note
• https://osv.dev/vulnerability/CVE-2019-14347 · Vendor Advisory
• https://t.me/cvenotify/45468 · Telegram Post
• ❌ https://github.com/ferdinandmartin/adive-php · Note, Deleted