PT-2020-16436 · Unknown · Garfield Petshop

Published 2020-10-09 · Updated 2024-02-14 · CVE-2020-26522

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Garfield Petshop versions prior to 2020-10-01

Description A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators for requests that create new administrative accounts.

Recommendations For versions prior to 2020-10-01, update to a version released after 2020-10-01 to resolve the issue.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-26522

Affected Products

Garfield Petshop

References · 6

• 🔥 http://rysec.io/adv/Petshop_AddAdmin_Exploit.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-26522 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26522 · Vendor Advisory
• https://detapos.co · Note
• http://packetstormsecurity.com/files/159520/Garfield-Petshop-2020-10-01-Cross-Site-Request-Forgery.html · Note
• https://demo.detapos.co.id/petshop · Note