Loading
PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges (including administrator). A remote unauthenticated user can craft an HTTP request and override attributes of the 'include' directive in /public/login.htm and perform a Local File Inclusion attack, by including /api/addusers and executing it. By providing the 'id' and 'users' parameters, an unauthenticated attacker can create a user with read-write privileges (including administrator).
Use Paessler vendor hub and Prtg Network Monitor product page to widen CVE-2018-19410 into its surrounding weakness, vendor, and product context.
Compare it with CVE-2023-31452, CVE-2023-32782 and CVE-2023-32781 for nearby disclosures in the same product family. Additional editorial context is available in Why “Low” and “Medium” CVEs Still Breach Networks.