PT-2022-27732 · Unknown · Helmet Store Showroom

Yuyudhn · Published 2022-12-14 · Updated 2023-01-30 · CVE-2022-46074

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Helmet Store Showroom version 1.0

Description The issue allows an unauthenticated user to add an admin account due to missing Cross Site Request Forgery (CSRF) protection. This enables an attacker to perform actions on behalf of other users without their knowledge or consent.

Recommendations For Helmet Store Showroom version 1.0, consider implementing proper CSRF protection mechanisms to prevent unauthorized actions. As a temporary workaround, restrict access to admin account creation functionality until a patch is available.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-46074

Affected Products

Helmet Store Showroom

References · 5

• 🔥 https://yuyudhn.github.io/CVE-2022-46074 · Exploit
• 🔥 https://youtube.com/watch?v=5Q3vyTo02bc&ab_channel=IkariShinji · Exploit
• https://osv.dev/vulnerability/CVE-2022-46074 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-46074 · Security Note
• https://t.me/cibsecurity/54527 · Telegram Post