Description
All-Dynamics Digital Signage System 2.0.2 contains a cross-site request forgery vulnerability that allows attackers to create administrative users without proper request validation. Attackers can craft a malicious web page that automatically submits forms to create a new user with global administrative privileges when a logged-in user visits the page.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| All-Dynamics Software | Digital Signage System | 2.0.2 (Build 2098) ILP32W | — |
References
- ExploitDB-48736 exploit
- Zero Science Advisory ID ZSL-2020-5576 third-party-advisory
- All-Dynamics Software GmbH Homepage product
- VulnCheck Advisory: All-Dynamics Digital Signage System 2.0.2 Cross-Site Request Forgery via User Management third-party-advisory