medium6.5Public exploit code
CVE-2020-8504
School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=addadmin CSRF to add an administrative user.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- School ERP System 1.0 - Cross Site Request Forgery (Add Admin)2020-02-03 · webapps · php
Impact
School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=addadmin CSRF to add an administrative user.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Arox | School Management Software Php\/Mysql | through 2019-03-14 |