Description
UBICOD Medivision Digital Signage 1.5.1 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts without proper request validation. Attackers can craft a malicious web page that submits a form to the /query/user/itSet endpoint to add a new admin user with elevated privileges.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| UBICOD Co., Ltd. | MEDIVISION | UBICOD Medivision Digital Signage | Firmware 1.5.1 (2013.01.3) | — |
References
- ExploitDB-48694 exploit
- UBICOD Medivision Digital Signage Product Homepage product
- Zero Science Advisory for ZSL-2020-5574 vendor-advisory
- VulnCheck Advisory: UBICOD Medivision Digital Signage 1.5.1 Cross-Site Request Forgery via User Management third-party-advisory