Description
In Rukovoditel 2.5.2 has a form_session_token value to prevent CSRF attacks. This protection mechanism can be bypassed with another user's valid token. Thus, an attacker can change the Admin password by using a CSRF attack and escalate his/her privileges.
Remediation
References
Related Vulnerabilities
Liferay Portal Insufficiently Protected Credentials Vulnerability (CVE-2021-29043)
WordPress Plugin Acurax On Click Pop Under Multiple Unspecified Vulnerabilities (2.2.1)
WordPress Improper Input Validation Vulnerability (CVE-2017-1000600)
WordPress Plugin Redirection Cross-Site Request Forgery (3.6.2)