CVEs-PoC/2021/CVE-2021-26598.md

CVE-2021-26598

Description

ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated attackers (who are, by design, able to have a security token).

POC

Reference

• http://karmainsecurity.com/KIS-2022-03
• https://packetstormsecurity.com/files/166403/ImpressCMS-1.4.2-Incorrect-Access-Control.html

Github

• https://github.com/20142995/nuclei-templates
• https://github.com/ARPSyndicate/cve-scores
• https://github.com/ARPSyndicate/cvemon
• https://github.com/ARPSyndicate/kenzer-templates