PT-2022-12545 · Unknown · Vehicle Service Management System

P.L.Sanu · Published 2022-01-06 · Updated 2022-01-13 · CVE-2021-46067

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vehicle Service Management System version 1.0

Description The issue allows an attacker to steal cookies, leading to Full Account Takeover.

Recommendations For Vehicle Service Management System version 1.0, consider implementing additional security measures to protect user session cookies, such as using secure protocols for cookie transmission and storage, until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2021-46067

Affected Products

Vehicle Service Management System

References · 6

• 🔥 https://plsanu.com/vehicle-service-management-system-multiple-cookie-stealing-leads-to-full-account-takeover · Exploit
• 🔥 https://github.com/plsanu/Vehicle-Service-Management-System-Multiple-Cookie-Stealing-Leads-to-Full-Account-Takeover · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-46067 · Security Note
• https://osv.dev/vulnerability/CVE-2021-46067 · Vendor Advisory
• https://t.me/cibsecurity/35056 · Telegram Post
• https://t.me/cvenotify/25388 · Telegram Post