CVE-2017-7446
HighSummary
HelpDEZk version 1.1.1 has a CSRF vulnerability in the path admin/home#/person/, allowing for the acquisition of admin privileges.
Risk Assessment
Exploitation of this vulnerability could lead to unauthorized access to administrative functions, posing a threat to system security.
Recommendation
It is recommended to update HelpDEZk to the latest version and implement protections against CSRF attacks.
Other vulnerabilities in HelpDEZk 1.1.1
See all- CVE-2017-14146High
HelpDEZk version 1.1.1 allows remote authenticated users to execute arbitrary PHP code by uploading a .php attachment and then requesting it in the helpdezk\app\uploads\helpdezk\attachments\ directory.
- CVE-2017-7447High
HelpDEZk version 1.1.1 has a CSRF vulnerability in admin/home#/logos/, which can lead to remote execution of arbitrary PHP code.
- CVE-2017-14145Critical
HelpDEZk version 1.1.1 has an SQL Injection vulnerability in the loginController.php file, occurring in the selectWarning function. This issue is related to the admin/login/getWarningInfo/id/ PATH_INFO.
Original NVD description (English source)
HelpDEZk 1.1.1 has CSRF in admin/home#/person/ with an impact of obtaining admin privileges.