ModStartCMS V4.6.0 has a vulnerability, Cross-site request forgery(CSRF)

[Rookie-is]

Build ModStartCMSv4.6.0 locally Background, background permissions -> administrator -> add Click to add a user test packet capture send csrf poc Click to send，refresh background New administrator test appears

[Rookie-is]

本地搭建 ModStartCMSv4.6.0 后台，后台权限->管理员->添加 点击添加，添加管理员test 抓包 发送csrf poc

点击发送，刷新后台，test管理员添加成功

[Rookie-is]

可以为cookie添加SameSite 属性来解决这个问题

[Rookie-is]

This problem can be solved by adding the SameSite attribute to the cookie

[modstart]

released