CVE-2017-17990
HighSummary
The Biometric Shift Employee Management System has a CSRF vulnerability in index.php in the edit_holiday action.
Risk Assessment
An attacker could exploit this vulnerability to perform unauthorized actions on behalf of a logged-in user, potentially leading to unauthorized changes in the system.
Recommendation
It is recommended to implement CSRF tokens in forms and verify the source of requests to minimize the risk of attacks.
Other vulnerabilities in Biometric Shift Employee Management System
See all- CVE-2017-17876High
Biometric Shift Employee Management System 3.0 allows remote attackers to bypass intended file-read restrictions via a user=download request with a pathname in the path parameter.
- CVE-2017-17992Critical
The Biometric Shift Employee Management System allows arbitrary file download via directory traversal sequences in the form_file_name parameter in a download_form action.
Original NVD description (English source)
Biometric Shift Employee Management System has CSRF via index.php in an edit_holiday action.