Description
Snews CMS 1.7 contains a cross-site request forgery vulnerability that allows attackers to change administrator credentials without authentication by crafting malicious HTML forms. Attackers can trick authenticated administrators into visiting a page containing a hidden form that submits POST requests to the changeup action, modifying the admin username and password parameters to gain unauthorized access.
Problem types
Cross-Site Request Forgery (CSRF)
Product status
Credits
Ashiyane Digital Security Team
References
www.exploit-db.com/exploits/40705 (ExploitDB-40705)
www.vulncheck.com/...cross-site-request-forgery-via-changeup (VulnCheck Advisory: Snews CMS 1.7 Cross-Site Request Forgery via changeup)