CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in Uncodethemes Ultra Demo Importer ut-demo-importer allows Upload a Web Shell to a Web Server.This issue affects Ultra Demo Importer: from n/a through <= 1.0.5.
Explanation of Vulnerability in Simple Terms
Ultra Demo Importer versions 1.0.5 and earlier are vulnerable to cross-site request forgery (CSRF). An attacker can trick a site administrator into performing unintended actions—such as importing malicious demo content or modifying site settings—by crafting a malicious link or page. The vulnerability affects all users and can result in unauthorized changes to site data.
What an attacker can do
Trick an admin into performing unintended actions like importing malicious content or changing site settings.
Potential impact on your site
Attackers can modify site content, settings, or import malicious demo data without your knowledge or consent.
Conditions required to exploit
Admin must visit a malicious link or page while logged in to the site.
Key dates
External resources
