Description
In Rukovoditel 2.5.2 has a form_session_token value to prevent CSRF attacks. This protection mechanism can be bypassed with another user's valid token. Thus, an attacker can change the Admin password by using a CSRF attack and escalate his/her privileges.
Remediation
References
Related Vulnerabilities
WordPress Plugin Email Subscriber Cross-Site Scripting (1.1)
Microsoft SQL Server CVE-2023-32028 Vulnerability (CVE-2023-32028)
Joomla Insufficient Session Expiration Vulnerability (CVE-2021-26037)
ownCloud Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2012-4753)
Oracle Application Server Other Vulnerability (CVE-2005-2093)