The lukashuser EKC Tournament Manager versions up to 2.2.1 contain a CSRF vulnerability that enables an attacker to upload a web shell to the web server hosting the application. This vulnerability requires no privileges and only user interaction, but the attacker can cause a state change on the server, leading to complete compromise. The CVSS 3.1 base score is 9.6, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to upload a web shell, which can lead to full system compromise including unauthorized access, data theft, and service disruption. The vulnerability affects confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is released, it is recommended to implement CSRF protections such as verifying anti-CSRF tokens on sensitive actions and restricting access to the application to trusted users only. Monitor for unusual upload activity and consider disabling file upload functionality if not required.