GHSA-gx8m-hc2r-m9f9MediumCVSS 5.3
bloofoxCMS 0.5.2.1 contains a cross-site request forgery vulnerability that allows attackers to...
🔗 CVE IDs covered (1)
📋 Description
bloofoxCMS 0.5.2.1 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions by tricking logged-in users into visiting malicious pages. Attackers can craft hidden forms targeting the admin user creation endpoint to add new administrative accounts with arbitrary credentials without requiring explicit user consent.
🔗 References (6)
- https://nvd.nist.gov/vuln/detail/CVE-2020-37241
- https://github.com/alexlang24/bloofoxCMS/releases/tag/0.5.2.1
- https://www.bloofox.com
- https://www.exploit-db.com/exploits/49507
- https://www.vulncheck.com/advisories/bloofoxcms-cross-site-request-forgery-via-user-add
- https://github.com/advisories/GHSA-gx8m-hc2r-m9f9