Description
iDS6 DSSPro Digital Signage System 6.2 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without request validation. Attackers can craft malicious web pages to trick logged-in administrators into adding unauthorized users by exploiting the lack of CSRF protections.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Yerootech | iDS6 DSSPro Digital Signage System | 6.2 B2014.12.12.1220, 5.6 B2017.07.12.1757, 4.3 | — |
References
- ExploitDB-48990 exploit
- Zero Science Lab Disclosure (ZSL-2020-5606) third-party-advisory
- Archived Yeroo Tech Vendor Homepage product
- Packet Storm Security Exploit Entry exploit
- IBM X-Force Vulnerability Exchange vdb-entry
- CXSecurity Vulnerability Database Entry exploit
- VulnCheck Advisory: iDS6 DSSPro Digital Signage System 6.2 Cross-Site Request Forgery via User Management third-party-advisory