CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database allows Accessing Functionality Not Properly Constrained by ACLs, Cross Site Request Forgery.This issue affects Participants Database: from n/a through 2.5.5.
Explanation of Vulnerability in Simple Terms
Participants Database versions up to 2.5.5 lack proper authorization checks, allowing authenticated users to modify data they should not have access to. An attacker with a low-privilege account can alter records without proper permission validation. The vulnerability affects the integrity of participant information but does not expose confidential data or cause service disruption.
What an attacker can do
Modify participant records or settings without proper authorization.
Potential impact on your site
Participant data can be altered by unauthorized users, compromising data integrity and trust.
Conditions required to exploit
Attacker must have a valid low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
