OFCMS Cross-Site Request Forgery Vulnerability

A cross-site request forgery (CSRF) vulnerability has been identified in OFCMS version 1.1.3. The issue arises from an unknown function, allowing remote attackers to manipulate requests and potentially change sensitive information, such as administrator passwords.

Impact

Exploitation of this vulnerability allows for cross-site request forgery, where an attacker can trick a user into performing actions they did not intend to, such as changing passwords or other personal information.

Reproduction

To reproduce this vulnerability, intercept a request to change a password using a tool like Burp Suite. Modify the request to include a CSRF payload, then send it. This will simulate a user clicking a link that performs the action, resulting in a successful password change.