SpinetiX Fusion Digital Signage Cross-Site Request Forgery Vulnerability Allowing Unauthorized Admin Account Creation

A cross-site request forgery (CSRF) vulnerability has been identified in SpinetiX Fusion Digital Signage version 3.4.8. This vulnerability allows attackers to create administrative user accounts without proper request validation. By crafting a malicious web page that automatically submits a form, attackers can exploit this vulnerability to gain full system privileges when a logged-in user visits the page.

Impact

Exploitation of this vulnerability allows for the creation of admin accounts, granting full system privileges to the attacker.

Reproduction

To reproduce this vulnerability, a form must be created that includes the necessary fields to create a new user account, such as username, password, and user role. This form should be set to submit to the user creation endpoint of the SpinetiX Fusion application. When a logged-in user visits the page hosting this form, the request will be sent automatically, creating a new admin account without their knowledge.