CVE-2024-6662 CSRF in MegaBIP
A CSRF vulnerability in MegaBIP allows attackers to trick administrators into creating new accounts with administrative privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-6662?
CVE-2024-6662 is a high-severity vulnerability in Jan Syski MegaBIP, published on 10 Jan 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Websites managed by MegaBIP in versions below 5.15 are vulnerable to Cross-Site Request Forgery (CSRF) as the form available under "/edytor/index.php?id=7,7,0" lacks protection mechanisms. A user could be tricked into visiting a malicious website, which would send POST request to this endpoint. If the victim is a logged in administrator, this could lead to creation of new accounts and granting of administrative permissions.
Weakness: CWE-352
Which versions are affected by CVE-2024-6662?
How do I fix CVE-2024-6662?
No fix has been published for CVE-2024-6662 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-6662 being exploited?
There is no known exploitation of CVE-2024-6662 in the wild and no public exploit code.
Sources
Also known as GHSA-c4hf-853m-qmw7.