Description
Easy2Pilot 7 contains a cross-site request forgery vulnerability that allows attackers to add unauthorized user accounts by tricking authenticated administrators into visiting malicious pages. Attackers can craft HTML forms targeting the admin.php?action=add_user endpoint with POST requests containing username and password parameters to create new administrative accounts without explicit user consent.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Easy2Pilot | Easy2Pilot | 7 | — |
References
- ExploitDB-48099 exploit
- Official Product Homepage product
- VulnCheck Advisory: Easy2Pilot 7 Cross-Site Request Forgery via admin.php third-party-advisory