CVE-2019-14347

moderate-risk
Published 2019-08-06

Internal/Views/addUsers.php in Schben Adive 2.0.7 allows remote unprivileged users (editor or developer) to create an administrator account via admin/user/add, as demonstrated by a Python PoC script.

Do I need to act?

~
5.8% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
1 public exploit available
47600
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10 High
NETWORK / LOW complexity

Affected Products (1)

Adive

Affected Vendors

Schben

References (6)

Exploit http://packetstormsecurity.com/files/155213/Adive-Framework-2.0.7-Privilege-Esca...
Broken Link https://github.com/ferdinandmartin/adive-php
Exploit https://hackpuntes.com/cve-2019-14347-escalacion-de-privilegios-en-adive/
Exploit http://packetstormsecurity.com/files/155213/Adive-Framework-2.0.7-Privilege-Esca...
Broken Link https://github.com/ferdinandmartin/adive-php
Exploit https://hackpuntes.com/cve-2019-14347-escalacion-de-privilegios-en-adive/
44
/ 100
moderate-risk
Severity 30/34 · Critical
Exploitability 9/34 · Low
Exposure 5/34 · Minimal