dingfanzu CMS Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in dingfanzu CMS version 1.0. The issue arises in the admin component, specifically within the 'doAdminAction.php' file, where an attacker can exploit the vulnerability by sending a crafted request to add a shop.

Impact

Exploitation of this vulnerability allows for Cross-Site Request Forgery, where an attacker can trick a user into performing actions they did not intend to.

Reproduction

To reproduce this vulnerability, send a request to the '/admin/doAdminAction.php' endpoint with the 'act' parameter set to 'addShop'. This can be done using a CSRF exploit that targets users with an active session on the application.