ShishuoCMS Cross-Site Request Forgery Vulnerability

A cross-site request forgery (CSRF) vulnerability exists in ShishuoCMS version 1.1. This issue allows remote attackers to manipulate certain processing functions, potentially leading to unauthorized actions being performed on behalf of users.

Impact

Exploitation of this vulnerability allows for cross-site request forgery, where an attacker can trick a user into performing actions they did not intend to, such as adding an administrator.

Reproduction

To reproduce this vulnerability, upload a crafted CSRF proof-of-concept (PoC) to the server. Once uploaded, simulate an administrator clicking on the PoC. After the click, verify if the administrator has been successfully added.