CVE-2018-8908 An issue was discovered in /admin/?/user/add in Frog CMS 0.9.5. The application's add user functionality suffers from CSRF. A malicious user can craft an HTML page and use it to trick a victim into cl...
HighCVSS 8.8
EPSS 2.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered in /admin/?/user/add in Frog CMS 0.9.5. The application's add user functionality suffers from CSRF. A malicious user can craft an HTML page and use it to trick a victim into clicking on it; once executed, a malicious user will be created with admin privileges. This happens due to lack of an anti-CSRF token in state modification requests.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| frog cms project frog cms | = 0.9.5 | No fix listed |
References
- securitywarrior9.blogspot.in exploit third-party-advisory
- 44383 exploit third-party-advisory vdb-entry