CVE-2024-0880 - Qidianbang qdbcrm Password Reset cross-site request forgery

Back Back to CVE browser

HIGH

Qidianbang qdbcrm Password Reset cross-site request forgery

Published Jan 25, 2024

8.8

HIGH

CVSS 3.1

EPSS 0.41%

Description

A vulnerability was found in Qidianbang qdbcrm 1.1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /user/edit?id=2 of the component Password Reset. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252032. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

Vendor Qidianbang Product Qdbcrm Default
n/a
- Version
  1.1.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Qidianbang

Qdbcrm

n/a

Version	Status	Constraints
1.1.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-352

CSRF

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-16662
Advisory
https://github.com/gtqbhksl/weekdays_something/blob/main/qdb_csrf.md
exploitThird Party Advisory
https://vuldb.com/?ctiid.252032
signaturepermissions-requiredThird Party Advisory
https://vuldb.com/?id.252032
vdb-entryThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-16662		Advisory
https://github.com/gtqbhksl/weekdays_something/blob/main/qdb_csrf.md		exploitThird Party Advisory
https://vuldb.com/?ctiid.252032		signaturepermissions-requiredThird Party Advisory
https://vuldb.com/?id.252032		vdb-entryThird Party Advisory