Description
Arunna 1.0.0 contains a cross-site request forgery vulnerability that allows attackers to manipulate user profile settings without authentication. Attackers can craft a malicious form to change user details, including passwords, email, and administrative privileges by tricking authenticated users into submitting the form.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Arunna | Arunna | 1.0.0 | — |
References
- ExploitDB-50608 exploit
- Archived Researcher Blog exploit technical-description
- Arunna GitHub Repository product