Windu CMS Cross-Site Request Forgery Vulnerability in File Uploading Functionality

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in Windu CMS version 4.1, allowing attackers to upload malicious files to the server. This issue arises because the CSRF protection mechanism can be bypassed by using a token from another user. While the vendor was notified about this vulnerability, no details regarding the affected version range were provided. Only version 4.1 has been tested and confirmed as vulnerable, leaving the status of other versions uncertain.

Impact

Exploitation of this vulnerability allows for Cross-Site Request Forgery attacks, where an attacker can trick a user into uploading a malicious file to the server.