07FLYCMS Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in 07FLYCMS version 1.3.9. The issue resides in the OaTask editing component, accessible through the erp.07fly.net domain.

Impact

Exploitation of this vulnerability allows for Cross-Site Request Forgery, where an attacker can trick a user into performing actions without their consent.

Reproduction

To reproduce this vulnerability, a CSRF proof of concept can be created by sending a POST request to the OaTask edit endpoint. The request must include several hidden fields, such as 'id', 'name', 'start_time', 'end_time', 'owner_user_id', 'progress', and 'content'. This can be done using a simple HTML form that automatically submits these values.