CyberRota Analysis
AI-GeneratedThe UVdesk Community Skeleton versions up to 1.1.8 are vulnerable due to a lack of authentication and validation on wizard endpoints, allowing unauthenticated attackers to manipulate the database and create super administrator accounts. This critical vulnerability can lead to complete compromise of the affected instance, enabling attackers to gain full control over the application. Organizations using this software should prioritize immediate remediation to mitigate the risk of unauthorized access and potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated attackers can repoint the database and create super administrator accounts by submitting crafted requests to wizard endpoints, gaining full control of the instance.