ModStartCMS V4.6.0 has a vulnerability, Cross-site request forgery(CSRF)

[Rookie-is]

Build ModStartCMSv4.6.0 locally
Background, background permissions -> administrator -> add

Click to add a user test

packet capture

send csrf poc



Click to send，refresh background


New administrator test appears

[Rookie-is]

本地搭建 ModStartCMSv4.6.0
后台，后台权限->管理员->添加

点击添加，添加管理员test

抓包

发送csrf poc

点击发送，刷新后台，test管理员添加成功

[Rookie-is]

可以为cookie添加SameSite 属性来解决这个问题

[Rookie-is]

This problem can be solved by adding the SameSite attribute to the cookie

[modstart]

released