CVE-2021-37394

EUVD-2021-23963
In RPCMS v1.8 and below, attackers can interact with API and change variable "role" to "admin" to achieve admin user registration.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 61%
Affected Products (NVD)
VendorProductVersion
rpcmsrpcms
𝑥
≤ 1.8
𝑥
= Vulnerable software versions
References
https://gist.github.com/victomteng1997/bfa1e0e07dd22f7e0b13256eda79626f
https://github.com/ralap-z/RPCMS/
https://gist.github.com/victomteng1997/bfa1e0e07dd22f7e0b13256eda79626f
https://github.com/ralap-z/RPCMS/