CyberRota Analysis
AI-GeneratedCentreStack versions prior to 17.4 are susceptible to a session variable injection vulnerability, allowing unauthenticated attackers to manipulate session variables through crafted input in the AccountName parameter. This exploitation can lead to unauthorized access to management pages by bypassing authentication checks, posing a risk to system integrity. Organizations using affected versions should prioritize patching to mitigate potential unauthorized access and protect sensitive data.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
CentreStack before 17.4 contains a session variable injection vulnerability that allows unauthenticated attackers to inject arbitrary session variables by embedding newline and tab characters into a crafted AccountName parameter posted to the SelectProvider.aspx endpoint. Attackers can exploit the lack of input sanitization in the custom session serialization format to inject a resellerid session variable, bypassing the IsValidRSession authentication check and gaining unauthorized access to management pages.