CVE-2022-47130

Summary

A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows a discount coupon to be arbitrarily created if an attacker with administrative privileges interacts on the CSRF page.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CVE Program Container

Additional References

• https://portswigger.net/web-security/csrf
• https://www.linkedin.com/in/xvinicius/
• https://xpsec.co/blog/academy-lms-5-10-coupon-csrf

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

Additional References

• https://github.com/OpenXP-Research/CVE-2022-47130

References

• https://portswigger.net/web-security/csrf
• https://www.linkedin.com/in/xvinicius/
• https://xpsec.co/blog/academy-lms-5-10-coupon-csrf

• ←Previous
• Next→