Windu CMS Cross-Site Request Forgery Vulnerability in User Editing Functionality

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in Windu CMS version 4.1, allowing attackers to delete users by sending a crafted POST request. The vulnerability exploits the user editing feature, where the CSRF protection mechanism can be bypassed using another user's CSRF token. Although the vendor was notified about this issue, no details regarding the vulnerability or affected version range were provided, leaving open the possibility that other versions may also be vulnerable.

Impact

Exploitation of this vulnerability allows for unauthorized user deletions, potentially disrupting user management and access control within the application.