STVS ProVision Cross-Site Request Forgery Vulnerability Allowing Unauthorized Admin Access

A cross-site request forgery (CSRF) vulnerability has been identified in STVS ProVision version 5.9.10. This vulnerability allows attackers to perform actions with administrative privileges by exploiting unvalidated HTTP requests. When a logged-in user visits a malicious website, the attacker can trigger a forged request that creates a new admin user.

Impact

Exploitation of this vulnerability allows for unauthorized administrative access, enabling the creation of new admin users.

Reproduction

To reproduce this vulnerability, a logged-in user must be tricked into visiting a malicious website that sends a forged HTTP request to the STVS ProVision application. The forged request must include the necessary parameters to create a new admin user, such as login, password, email, and role ID.