CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in lukashuser EKC Tournament Manager ekc-tournament-manager allows Upload a Web Shell to a Web Server.This issue affects EKC Tournament Manager: from n/a through <= 2.2.1.
Explanation of Vulnerability in Simple Terms
EKC Tournament Manager versions 2.2.1 and earlier are vulnerable to cross-site request forgery (CSRF) attacks. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unauthorized actions on the tournament manager without the admin's knowledge. The vulnerability affects all functionality accessible to authenticated users and can result in data modification, deletion, or disclosure.
What an attacker can do
Perform unauthorized actions (create, modify, or delete tournament data) on behalf of a logged-in administrator.
Potential impact on your site
Attackers can manipulate tournament data, user accounts, or settings without direct access to your site.
Conditions required to exploit
A site administrator must visit a malicious webpage while logged into the site.
Key dates
External resources
Related vulnerabilities
