Description
Precurio Intranet Portal 2.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by submitting crafted POST requests. Attackers can forge requests to the /public/admin/user/submitnew endpoint with user creation parameters to add new admin accounts without requiring CSRF tokens or user interaction.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Precurio | Precurio Intranet Portal | 2.0 | — |
References
- ExploitDB-45860 exploit
- VulnCheck Advisory: Precurio Intranet Portal 2.0 Cross-Site Request Forgery Add Admin third-party-advisory