DBHcms v1.2.0 has no CSRF protection mechanism,as demonstrated by CSRF for an /index.php?dbhcms_pid=-80&deletemenu=9 can delete any menu.

Published Aug 24, 2020 · Updated Aug 4, 2024 · Assigned by mitre