CVE-2018-25174: ABC ERP 0.6.4 Cross-Site Request Forgery via _configurar_perfil.php

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-06 · updated 2026-06-17
Weakness: CWE-352

Description

ABC ERP 0.6.4 contains a cross-site request forgery vulnerability that allows attackers to modify administrator credentials by submitting forged requests to _configurar_perfil.php. Attackers can craft malicious forms or links containing parameters like usuario, contrasena1, contrasena2, nombre, and email to change admin account settings without authentication.

Affected products

Abc-Erp ABC ERP: 0.6.4

References

https://www.exploit-db.com/exploits/45836
https://www.vulncheck.com/advisories/abc-erp-cross-site-request-forgery-via-configurar-perfilphp

Get alerted when CVE-2018-25174 or the next vulnerability affects your stack