Description
iDS6 DSSPro Digital Signage System 6.2 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without request validation. Attackers can craft malicious web pages to trick logged-in administrators into adding unauthorized users by exploiting the lack of CSRF protections.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Yerootech iDS6 DSSPro Digital Signage System
6.2 B2014.12.12.1220affected5.6 B2017.07.12.1757affected4.3affected
References
- https://www.exploit-db.com/exploits/48990 ↗
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5606.php ↗
- https://web.archive.org/web/20200919100215/http://www.yerootech.com/ ↗
- https://packetstormsecurity.com/files/159916 ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/191258 ↗
- https://cxsecurity.com/issue/WLB-2020110022 ↗
- https://www.vulncheck.com/advisories/ids-dsspro-digital-signage-system-cross-site-request-forgery-via-user-management ↗