Medium · 6.4 CVE-2024-35475 EUVD-2024-35341GHSA-85f4-3cvc-fmrq

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in OpenKM Community Edition on or before version 6.3.12. The vulnerability…

Published May 22, 2024 · Updated Feb 13, 2025 · Assigned by mitre

Description

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in OpenKM Community Edition on or before version 6.3.12. The vulnerability exists in /admin/DatabaseQuery, which allows an attacker to manipulate a victim with administrative privileges to execute arbitrary SQL commands.

References

https://github.com/carsonchan12345/OpenKM-CSRF-PoC
https://github.com/carsonchan12345/CVE-2024-35475