PT-2021-11745 · Unknown · Thinkadmin

Published 2021-03-03 · Updated 2024-07-04 · CVE-2020-35296

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: ThinkAdmin version 6

Description: The issue concerns default administrator credentials in ThinkAdmin, allowing attackers to gain unrestricted access to the administrator dashboard.

Recommendations: For ThinkAdmin version 6, change the default administrator credentials to secure ones as soon as possible to prevent unauthorized access. Consider temporarily restricting access to the administrator dashboard until the credentials are changed.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2020-35296

GHSA-CXV7-6JGF-7GWF

Affected Products

Thinkadmin

References · 8

• 🔥 https://smshrimant.com/admin-panel-access-using-default-credentials · Exploit
• 🔥 https://github.com/Shrimant12/CVE-References/blob/main/CVE-2020-35296.md · Exploit
• https://osv.dev/vulnerability/CVE-2020-35296 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35296 · Security Note
• https://osv.dev/vulnerability/GHSA-cxv7-6jgf-7gwf · Vendor Advisory
• https://github.com/zoujingli/ThinkAdmin · Note
• https://t.me/cibsecurity/24396 · Telegram Post
• https://twitter.com/BsidesJaipur/status/1808891744517288016 · Twitter Post