Description
Nodcms contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious forms. Attackers can trick authenticated administrators into submitting requests to admin/user_manipulate and admin/settings/generall endpoints to create users or modify application settings without explicit consent.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nodcms | nodCMS | 1.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | khodakhah/nodcms | <= 3.4.1 | — | GHSA-3qcm-pj6q-w4c5 |
References
- ExploitDB-40707 exploit