CVEs-PoC/2020/CVE-2020-28874.md

CVE-2020-28874

Description

reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly considered (an invalid token parameter).

POC

Reference

No PoCs from references.

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/developer3000S/PoC-in-GitHub
• https://github.com/nomi-sec/PoC-in-GitHub
• https://github.com/varandinawer/CVE-2020-28874