PT-2022-19970 · Lumidek Associates · Lumidek Associates Simple Food Website

Saket Saurav · Published 2022-05-23 · Updated 2022-05-30 · CVE-2022-30014

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lumidek Associates Simple Food Website version 1.0

Description The issue allows anyone to take over admin or moderator accounts due to Cross Site Request Forgery (CSRF). This means an attacker can perform actions on behalf of the admin or moderator without their knowledge or consent.

Recommendations For Lumidek Associates Simple Food Website version 1.0, consider implementing proper CSRF protection mechanisms, such as tokens or headers, to prevent unauthorized requests. As a temporary workaround, restrict access to admin and moderator accounts until a proper fix is applied.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-30014

Affected Products

Lumidek Associates Simple Food Website

References · 6

• 🔥 https://github.com/offsecin/bugsdisclose/blob/main/csrf · Exploit
• https://osv.dev/vulnerability/CVE-2022-30014 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30014 · Security Note
• https://t.me/cibsecurity/43180 · Telegram Post
• http://lumidek.com · Note
• http://simple.com · Note