Elevation-of-Privilege Vulnerability in hitshop: Unauthorized Administrator Account Creation

CVE-2018-19853 · MEDIUM Severity

AV:N/AC:L/AU:S/C:P/I:P/A:P

An issue was discovered in hitshop through 2014-07-15. There is an elevation-of-privilege vulnerability (that allows control over the whole web site) via the admin.php/user/add URI because a storekeeper account (which is supposed to have only privileges for commodity management) can add an administrator account.

Learn more about our Web App Pen Testing.