Cross-site request forgery (CSRF) vulnerability in /Cscms_4.2/upload/admin.php/sys/save allow remote attackers to change
administrator's username and password.
Trigger condition: the administrator clicks a malicious link
Cause of vulnerability:
We can find that this script has no anti CSRF mechanism.
details
In cscms v4.2 A problem was found in 1
Cross-site request forgery (CSRF) vulnerability in /Cscms_4.2/upload/admin.php/sys/save allow remote attackers to change
administrator's username and password.
Trigger condition: the administrator clicks a malicious link
Cause of vulnerability:
We can find that this script has no anti CSRF mechanism.
Exploit:
Login administrator click URL: http://ip/csrf.html
csrf. html:
/Cscms_4.2/upload/admin.php/sys/save

administrator click
success
The password has been successfully changed to 123
Repair method:
Join the random token check
The text was updated successfully, but these errors were encountered: