Description
In Rukovoditel 2.5.2 has a form_session_token value to prevent CSRF attacks. This protection mechanism can be bypassed with another user's valid token. Thus, an attacker can change the Admin password by using a CSRF attack and escalate his/her privileges.
Remediation
References
Related Vulnerabilities
TYPO3 Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2010-3663)
WordPress Plugin All In One Favicon Cross-Site Scripting (4.6)
OpenSSL Other Vulnerability (CVE-2015-0209)
LimeSurvey Other Vulnerability (CVE-2014-5018)
WordPress Plugin Photo Gallery by 10Web-Mobile-Friendly Image Gallery Cross-Site Scripting (1.5.67)