Improper Authorization in ThinkSAAS v2.7 allows remote attackers to modify the description of any user’s photo via the “photoid%5B%5D” and “photodesc%5B%5D” parameters in the component “index.php?app=photo.”
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-18741
Reference (s):
- https://github.com/thinksaas/ThinkSAAS/issues/19