Executive brief
Easy2Pilot 7, a web-based management application, is vulnerable to a security flaw that allows unauthorized users to be added to the system. By tricking a logged-in administrator into clicking a malicious link or visiting a compromised website, an attacker can silently create a new administrative account. This could lead to a full takeover of the application and its data by the attacker.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in Easy2Pilot 7 due to a lack of anti-CSRF tokens or similar validation on sensitive administrative actions. Specifically, the 'admin.php?action=add_user' endpoint processes POST requests for new user creation without verifying the intent of the authenticated administrator. An attacker can exploit this by hosting a malicious HTML form that, when loaded by a logged-in admin, automatically submits a request to create a new account with attacker-controlled credentials. This requires the administrator to have an active session and be lured into interacting with the malicious content. Successful exploitation results in unauthorized account creation, potentially with administrative privileges.
Affected products
- Easy2Pilot Easy2Pilot 7
Timeline
- 2020-02-20: disclosed: Initial exploit published on Exploit-DB
- 2026-05-13: advisory: NVD and VulnCheck advisory published