Description
Business Live Chat Software 1.0 contains a cross-site request forgery vulnerability that allows attackers to change user account roles without authentication. Attackers can craft a malicious HTML form to modify user privileges by submitting a POST request to the user creation endpoint with administrative access parameters.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Bdtask | Business Live Chat Software | 1.0 | — |
References
- ExploitDB-48141 exploit
- Business Live Chat Software Vendor Homepage product
- VulnCheck Advisory: Business Live Chat Software 1.0 - Cross-Site Request Forgery (Add Admin) third-party-advisory