CSRF Bypass Vulnerability in Rukovoditel by Ruko

CVE-2020-11818

What is CVE-2020-11818?

A vulnerability exists in Rukovoditel 2.5.2 where the security measure designed to prevent CSRF attacks, specifically the form_session_token, can be bypassed if an attacker obtains a valid token of another user. This allows the attacker to perform unauthorized actions such as changing the administrator password, leading to potential privilege escalation and unauthorized access to sensitive administrative functions.

References