VictorAlagwu CMSsite 1.0 users.php add_user/edit_user cross-site request forgery

Summaryinfo

A vulnerability, which was classified as problematic, was found in VictorAlagwu CMSsite 1.0. Impacted is the function add_user/edit_user of the file users.php. Such manipulation leads to cross-site request forgery. This vulnerability is listed as CVE-2019-25682. The attack may be performed from remote. In addition, an exploit is available.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in VictorAlagwu CMSsite 1.0. Affected by this issue is the function add_user/edit_user of the file users.php. The manipulation with an unknown input leads to a cross-site request forgery vulnerability. Using CWE to declare the problem leads to CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. Impacted is integrity. CVE summarizes:

CMSsite 1.0 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious HTML forms. Attackers can trick authenticated administrators into visiting crafted pages that submit POST requests to the users.php endpoint with parameters like source=add_user, source=edit_user, or del=1 to create, modify, or delete admin accounts.

The weakness was presented by Mr Winst0N as 46480. The advisory is shared for download at exploit-db.com. This vulnerability is handled as CVE-2019-25682 since 04/05/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. Technical details as well as a public exploit are known.

The exploit is available at exploit-db.com. It is declared as proof-of-concept. By approaching the search of inurl:users.php it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Exploit-DB (46480). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• VictorAlagwu

Name

• CMSsite

Version

• 1.0

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion