Threats tagged 'ghsa-wm25-49w3-5qrg'

AdminNeo versions prior to 5.5.1 have a vulnerability in their CSRF token implementation that allows an attacker who observes a single CSRF token to recover the session secret instantly and forge unlimited valid CSRF tokens. This flaw arises because the token transmits both the XOR mask and the masked value, enabling trivial secret recovery. The session token entropy is low (~20 bits), making brute-force attacks feasible even without token observation. Exploitation allows attackers to perform unauthorized SQL commands through the victim's session, including creating backdoor users and dropping tables.