wellcms v2.2.0 has a vulnerability, Cross-site request forgery(CSRF)

[zhangzhijie98]

version:2.2.0
position:Background - > manage users - > create users


add a new users, and grab a package.


use CSRF poc,and drop the package.


submit request.


success add a new user(administrator).

[wellcms]

Thanks for submitting, this is equivalent to use your own key, duplicate a key. Just create it directly!