cbcvebase.
CVE-2019-14347
published 2019-08-06

CVE-2019-14347: Internal/Views/addUsers.php in Schben Adive 2.0.7 allows remote unprivileged users (editor or developer) to create an administrator account via admin/user/add…

PriorityP261high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EXPLOIT
EPSS
9.31%
94.8th percentile
Internal/Views/addUsers.php in Schben Adive 2.0.7 allows remote unprivileged users (editor or developer) to create an administrator account via admin/user/add, as demonstrated by a Python PoC script.

Affected

1 ranges
VendorProductVersion rangeFixed in
schbenadive<= 2.0.7—

Detection & IOCsextracted from sources · hover to see the quote

path/adive/admin/user/add↗
pathInternal/Views/addUsers.php↗
  • →Detect POST requests to /adive/admin/user/add from sessions authenticated as non-administrator roles (editor or developer). A low-privileged user creating an account with permission=1 (Administrator) is the exploit condition. ↗
  • →Monitor POST body parameters to /adive/admin/user/add for the field 'permission' set to '1', which corresponds to Administrator privilege assignment by a non-admin user. ↗
  • →The exploit posts the following form fields to the user creation endpoint: userName, userUsername, pass, cpass, permission — alert on this combination from low-privileged sessions. ↗
  • ·The PoC hardcodes proxy settings pointing to a local Burp Suite instance; real-world attacker traffic will not use these proxy addresses, so proxy-based detection on 127.0.0.1:8080 is not reliable. ↗
  • ·The exploit targets Adive Framework version 2.0.7 specifically; the NVD description references version 2.0.7 while the PoC banner prints '2.0.5', indicating the script may be reused across minor versions. ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.