CVE-2022-1248
SAP Information System POST Request add_admin.php improper authentication
HIGH 7.3EPSS 1.4%
A vulnerability was found in SAP Information System 1.0 which has been rated as critical. Affected by this issue is the file /SAP_Information_System/controllers/add_admin.php. An unauthenticated attacker is able to create a new admin account for the web application with a simple POST request. Exploit details were disclosed.
- Affected
- unspecified · SAP Information System
- CVSS v3.1 NVD
- 7.3 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - CVSS v2.0 NVD
- 7.5 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P - EPSS
- 1.35% chance of exploitation in the next 30 days, 71st percentile
- Published
- 2022-04-06
- Updated
- 2025-04-15
Proof-of-concept exploits (2)
- http://packetstormsecurity.com/files/166609/SAP-Information-System-1.0.0-Missing-Authoriz…
- https://vuldb.com/?id.196550