jizhicms v2.3.1 has a vulnerability, Cross-site request forgery(CSRF)

[zhangzhijie98]

version：v2.3.1

The issue in the background - > User Management - > administrator list

add a administrator and grab a package.


use CSRF poc and drop the package.


submit


Super administrator added successfully

[Cherry-toto]

是的，系统后台没有限制CSRF，如果你泄露后台，很可能被攻击！！！