PT-2026-23700 · Unknown · Easyndexer

Published 2026-03-06 · Updated 2026-03-06 · CVE-2018-25190

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Easyndexer version 1.0

Description The software contains a cross-site request forgery issue that permits unauthenticated attackers to create administrative accounts. This is achieved by submitting crafted POST requests. Attackers can create malicious web pages that submit POST requests to the ''createuser.php'' endpoint. The request includes parameters such as username, password, name, surname, and privileges. Setting privileges to 1 grants administrator access.

Recommendations Apply a fix to prevent the creation of administrative accounts via forged POST requests to the ''createuser.php'' endpoint.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2018-25190

Affected Products

Easyndexer

References · 4

• 🔥 https://exploit-db.com/exploits/45815 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-25190 · Security Note
• https://vulncheck.com/advisories/easyndexer-cross-site-request-forgery-via-createuserphp · Note
• https://t.me/CVEtracker/46605 · Telegram Post