Description
Sistem Informasi Pengumuman Kelulusan Online 1.0 contains a cross-site request forgery vulnerability that allows attackers to add unauthorized admin users through the tambahuser.php endpoint. Attackers can craft a malicious HTML form to submit admin credentials and create new administrative accounts without the victim's consent.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Adikiss | Sistem Informasi Pengumuman Kelulusan Online | latest | — |
References
- ExploitDB-48571 exploit
- Vendor Homepage product
- Software Download Page product
- VulnCheck Advisory: Sistem Informasi Pengumuman Kelulusan Online 1.0 - Cross-Site Request Forgery third-party-advisory