PT-2021-11583 · Seacms · Seacms

Published 2021-08-17 · Updated 2021-08-25 · CVE-2020-28846

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: SeaCMS version 10.7

Description: A Cross Site Request Forgery (CSRF) issue exists in the admin manager.php file, which could allow a malicious user to add an admin account. This could potentially lead to unauthorized access and control of the system.

Recommendations: For SeaCMS version 10.7, consider disabling access to the admin manager.php file until a patch is available to prevent exploitation of the CSRF vulnerability. Restricting access to this file can help minimize the risk of adding unauthorized admin accounts.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-28846

Affected Products

Seacms

References · 5

• 🔥❌ https://github.com/wh1tes/wh1te_blog/issues/8 · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2020-28846 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-28846 · Security Note
• https://t.me/cibsecurity/27440 · Telegram Post
• https://t.me/cvenotify/20020 · Telegram Post