PT-2022-25882 · Rpcms · Rpcms

Ahisec · Published 2022-10-13 · Updated 2022-10-14 · CVE-2022-41475

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RPCMS version 3.0.2

Description The issue allows attackers to arbitrarily add an administrator account due to a Cross-Site Request Forgery (CSRF). This can be exploited by attackers to gain unauthorized access to the system.

Recommendations For RPCMS version 3.0.2, consider disabling the functionality that allows adding administrator accounts until a patch is available. Restrict access to sensitive areas of the application to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-41475

Affected Products

Rpcms

References · 4

• 🔥 https://github.com/ralap-z/rpcms/issues/2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-41475 · Security Note
• https://osv.dev/vulnerability/CVE-2022-41475 · Vendor Advisory
• https://t.me/cibsecurity/51323 · Telegram Post