Description
UBICOD Medivision Digital Signage 1.5.1 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts without proper request validation. Attackers can craft a malicious web page that submits a form to the /query/user/itSet endpoint to add a new admin user with elevated privileges.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
UBICOD Co., Ltd. | MEDIVISION INC. UBICOD Medivision Digital Signage
Default version status: unaffected
Firmware 1.5.1 (2013.01.3)affected