CVE-2018-13040

OpenSID 18.06-pasca is affected by a CSRF vulnerability that can add an administrator-level account via the index.php/man_user/insert URI. The issue is described across multiple sources (including CVE-2018-13040 in NVD and CNVD/OSV entries), identifying the vulnerable component as the admin user-...

CVE-2018-13040: Cross-Site Request Forgery (CSRF)

OpenSID 18.06-pasca has a CSRF vulnerability. This vulnerability can add an account at the admin level via the index.php/manuser/insert URI...

CVE-2018-13038: Unrestricted Upload of File with Dangerous Type

OpenSID 18.06-pasca has an Unrestricted File Upload vulnerability via an Attachment Document in the article feature. This vulnerability leads to uploading arbitrary PHP code via a .php filename with the application/pdf Content-Type...

CVE-2018-13039: Improper Neutralization of Input During Web Page Generation

OpenSID 18.06-pasca has reflected Cross Site Scripting XSS via the cari parameter, aka an index.php/first?cari= URI...