A Cross-Site Request Forgery (CSRF) in EyouCMS v1.6.2 allows attackers to execute arbitrary commands via a supplying a crafted HTML file to the Upload software format function.
cpe:2.3:a:eyoucms:eyoucms:1.6.2:*:*:*:*:*:*:*
5B87F220-D05C-4885-8C0E-E5BD8D8DFB66
OR
let's see the operation：

First,we should add the js and html in "Upload software format" .
Second,we clicked the submit,and use Burp suite to Intercept the packet.
<img width="1251" alt="屏幕截图 2023-04-16 170400" src="https://user-images.githubusercontent.com/60973265/232288495-074b92f6-7789-4a20-879d-ef7fd31a3a08.png">

Third,we use the csrf tools in burp suite profession to create CSRF poc
<img width="1255" alt="屏幕截图 2023-04-16 170911" src="https://user-images.githubusercontent.com/60973265/232288806-95284794-f2cc-4e49-90b3-056669a29773.png">

Put the poc into an html file and send it to the victim,when the administrator clicke the page ,this means we can upload the js/html file.

Fourth,When we use the administrator account to delete the administrator account, or delete the article, use burp suite to capture the package, make csrf poc
![image](https://user-images.githubusercontent.com/60973265/232289641-abc1c9d6-cdc2-4fdd-96c4-90b97230d850.png)

![image](https://user-images.githubusercontent.com/60973265/232289689-25a724ad-5332-48d2-90c4-44a5253442bf.png)
Fifth,We need a low permission account to publish the article, then put the two produced POCs into the html file, and then into the attachment
![image](https://user-images.githubusercontent.com/60973265/232289855-971966f8-929b-4d2c-bc3d-1b4a578b84f4.png)
When the administrator opens this attachment, the article and possibly the administrator are deleted, and this is not restricted by browser security
This is the code in question
![屏幕截图(83)](https://user-images.githubusercontent.com/60973265/232291394-da86ec24-f4d2-48e4-8aa1-178bb086df50.png)
Solution: Add the token authentication
Three csrf vulnerabilities, you can modify Settings, you can delete articles, you can delete users
This is a GitHub Issue
repo:eyoucms
owner:weng-xianhu
Title : Three csrf vulnerabilities, you can modify Settings, you can delete articles, you can delete users
Issue date:

--- start body ---
let's see the operation：

First,we should add the js and html in "Upload software format" .
Second,we clicked the submit,and use Burp suite to Intercept the packet.
<img width="1251" alt="屏幕截图 2023-04-16 170400" src="https://user-images.githubusercontent.com/60973265/232288495-074b92f6-7789-4a20-879d-ef7fd31a3a08.png">

Third,we use the csrf tools in burp suite profession to create CSRF poc
<img width="1255" alt="屏幕截图 2023-04-16 170911" src="https://user-images.githubusercontent.com/60973265/232288806-95284794-f2cc-4e49-90b3-056669a29773.png">

Put the poc into an html file and send it to the victim,when the administrator clicke the page ,this means we can upload the js/html file.

Fourth,When we use the administrator account to delete the administrator account, or delete the article, use burp suite to capture the package, make csrf poc
![image](https://user-images.githubusercontent.com/60973265/232289641-abc1c9d6-cdc2-4fdd-96c4-90b97230d850.png)

![image](https://user-images.githubusercontent.com/60973265/232289689-25a724ad-5332-48d2-90c4-44a5253442bf.png)
Fifth,We need a low permission account to publish the article, then put the two produced POCs into the html file, and then into the attachment
![image](https://user-images.githubusercontent.com/60973265/232289855-971966f8-929b-4d2c-bc3d-1b4a578b84f4.png)
When the administrator opens this attachment, the article and possibly the administrator are deleted, and this is not restricted by browser security
This is the code in question
![屏幕截图(83)](https://user-images.githubusercontent.com/60973265/232291394-da86ec24-f4d2-48e4-8aa1-178bb086df50.png)
Solution: Add the token authentication
--- end body ---

comments :
--- start comments ---

--- end comments ---