CVE-2020-35675

BigProf Online Invoicing System before 3.0 offers a functionality that allows an administrator to move the records of members across groups

published December 24, 2020

CVSS
—
EPSS
0%
Percentile
39.3
In the wild
Unconfirmed
What it is

BigProf Online Invoicing System before 3.0 offers a functionality that allows an administrator to move the records of members across groups. The applicable endpoint (admin/pageTransferOwnership.php) lacks CSRF protection, resulting in an attacker being able to escalate their privileges to Administrator and effectively taking over the application.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00464 · 39.3th percentile
Published
2020-12-24T03:05Z
EPSS history
Timeline
  • 24 DEC 03:05Z
    BigProf Online Invoicing System before 3.0 offers a functionality that allows an administrator to move the records of members across groups
    cvelistv5