Description
Data Center Audit 2.6.2 contains a cross-site request forgery vulnerability that allows attackers to reset administrator passwords without authentication by submitting crafted POST requests. Attackers can send requests to dca_resetpw.php with parameters updateuser, pass, pass2, and submit_reset to change the admin account password and gain administrative access.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Sourceforge | Data Center Audit | 2.6.2 | — |
References
- ExploitDB-45831 exploit
- VulnCheck Advisory: Data Center Audit 2.6.2 Cross-Site Request Forgery via dca_resetpw.php third-party-advisory