CVE-2020-11818

In Rukovoditel 2.5.2 has a form_session_token value to prevent CSRF attacks. This protection mechanism can be bypassed with another user's valid token. Thus, an attacker can change the Admin password by using a CSRF attack and escalate his/her privileges.

• CWE-352

• https://fatihhcelik.blogspot.com/2020/01/rukovoditel-csrf-bypass-privilege.htmlExploit, Third Party Advisory
• https://fatihhcelik.blogspot.com/2020/01/rukovoditel-csrf-bypass-privilege.htmlExploit, Third Party Advisory

Published

Apr 16, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-11812Rukovoditel 2.5.2 is affected by a SQL injection vulnerabili…9.8
• CVE-2020-11813In Rukovoditel 2.5.2, there is a stored XSS vulnerability on…5.4
• CVE-2020-11814A Host Header Injection vulnerability in qdPM 9.1 may allow …5.4
• CVE-2020-11815In Rukovoditel 2.5.2, attackers can upload arbitrary file to…9.8
• CVE-2020-11816Rukovoditel 2.5.2 is affected by a SQL injection vulnerabili…9.8
• CVE-2020-11817In Rukovoditel V2.5.2, attackers can upload an arbitrary fil…9.8
• CVE-2020-11819In Rukovoditel 2.5.2, an attacker may inject an arbitrary .p…9.8
• CVE-2020-1182A remote code execution vulnerability exists in Microsoft Dy…7.3
• CVE-2020-11820Rukovoditel 2.5.2 is affected by a SQL injection vulnerabili…9.8
• CVE-2020-11821In Rukovoditel 2.5.2, users' passwords and usernames are sto…5.3
• CVE-2020-11822In Rukovoditel 2.5.2, there is a stored XSS vulnerability on…6.1
• CVE-2020-11823In Dolibarr 10.0.6, if USER_LOGIN_FAILED is active, there is…5.4