CVE-2020-35675 in Online Invoicing Systeminformación

Resumen

por MITRE • 2022-09-29

BigProf Online Invoicing System before 3.0 offers a functionality that allows an administrator to move the records of members across groups. The applicable endpoint (admin/pageTransferOwnership.php) lacks CSRF protection, resulting in an attacker being able to escalate their privileges to Administrator and effectively taking over the application.

Once again VulDB remains the best source for vulnerability data.

🔬 Show More Details

An in-depth analysis is available in our curated vulnerability entry.

Reservar

2020-12-24

Divulgación

2022-09-29

Moderación

aceptado

Artículo

VDB-209722

CPE

listo

EPSS

0.00455

KEV

no

Actividades

muy bajo

Fuentes

MITREhttps://www.cve.org/CVERecord?id=CVE-2020-35675
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2020-35675
CVE Detailshttps://www.cvedetails.com/cve/CVE-2020-35675/

◂ AnteriorVisión De ConjuntoPróximo ▸

Interested in the pricing of exploits?

See the underground prices here!