| शीर्षक | https://github.com/TeamEasy/EasyCMS EasyCMS V1.6 CSRF vulnerability |
|---|
| विवरण | The UserAction.class.php file in EasyCMS V1.6 contains a CSRF vulnerability affecting the path /index.php?s=/admin/user/update/navTabId/listusers/callbackType/closeCurrent. This flaw arises from the system's lack of effective CSRF protection for user-submitted update requests. Attackers can exploit this vulnerability by creating malicious POC pages to trick logged-in users on www.easycms.com into accessing the system. The pages automatically submit POST requests containing user_id, username, email, and other parameters, allowing unauthorized account modifications. If an administrator is compromised, the entire system may be breached, jeopardizing data security and platform credibility. Regular users face the risk of account theft. |
|---|
| स्रोत | ⚠️ https://github.com/ueh1013/VULN/issues/16 |
|---|
| उपयोगकर्ता | zzzh (UID 94773) |
|---|
| सबमिशन | 22/01/2026 10:28 AM (8 महीनों पहले) |
|---|
| संयम | 05/02/2026 08:44 PM (14 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 123496 [EasyCMS 1.5 closeCurrent क्रॉस साइट रिक्वेस्ट फॉर्जरी] |
|---|
| अंक | 0 |
|---|