CVE-2020-8504

School Management Software PHP/mySQL through 2019-03-14 allows officeadmin/?action=addadmin CSRF to add an administrative user...

School ERP System 1.0 - Cross Site Request Forgery (Add Admin)

School ERP System 1.0 - Cross Site Request Forgery Add Admin Title: School ERP System 1.0 - Cross Site Request Forgery Add Admin Date: 2020-01-31 Exploit Author: J3rryBl4nks Vendor Homepage: https://sourceforge.net/projects/school-erp-ultimate/files/ Software Link:...

School ERP System 1.0 - Cross Site Request Forgery (Add Admin)

Title: School ERP System 1.0 - Cross Site Request Forgery Add Admin Date: 2020-01-31 Exploit Author: J3rryBl4nks Vendor Homepage: https://sourceforge.net/projects/school-erp-ultimate/files/ Software Link: https://sourceforge.net/projects/school-erp-ultimate/files/ Version ERP-Ultimate CVE:...

CVE-2020-8504

CVE-2020-8504 is a cross-site request forgery in School Management Software PHP/MySQL up to 2019-03-14 that allows an attacker to coerce an authenticated user to create an administrative account via the URL path office_admin/?action=addadmin. The vulnerability's root cause is CSRF lacking adequat...