An issue was discovered in Cscms 4.1.0. There is an admin.php/pay CSRF vulnerability that can change the payment account to redirect funds.
cpe:2.3:a:chshcms:cscms:4.1:*:*:*:*:*:*:*
1DCFB098-04A8-43FE-AF93-0BE46815BAA3
OR
Hi, I would like to report CSRF vulnerability  inCsCMS V4.1.
There is a CSRF vulnerability that can change of payment account to steal property.
POC:
1.Login to administrator panel.
2.Open below URL in browser which supports flash.
url:http://www.cscms.com/admin.php/pay
eg:
1.Before modification
![csrf1](https://user-images.githubusercontent.com/32690714/53869552-6c89f100-4033-11e9-90c9-114c9e3dc502.png)

2.CSRF POC
[csrfpoc.txt](https://github.com/chshcms/cscms/files/2935384/csrfpoc.txt)

3.After modification
![csrf2](https://user-images.githubusercontent.com/32690714/53869842-f934af00-4033-11e9-9da6-f982b7d23569.png)


Bug: CsCMS V4.1 CSRF
This is a GitHub Issue
repo:cscms
owner:chshcms
Title : Bug: CsCMS V4.1 CSRF
Issue date:

--- start body ---
Hi, I would like to report CSRF vulnerability  inCsCMS V4.1.
There is a CSRF vulnerability that can change of payment account to steal property.
POC:
1.Login to administrator panel.
2.Open below URL in browser which supports flash.
url:http://www.cscms.com/admin.php/pay
eg:
1.Before modification
![csrf1](https://user-images.githubusercontent.com/32690714/53869552-6c89f100-4033-11e9-90c9-114c9e3dc502.png)

2.CSRF POC
[csrfpoc.txt](https://github.com/chshcms/cscms/files/2935384/csrfpoc.txt)

3.After modification
![csrf2](https://user-images.githubusercontent.com/32690714/53869842-f934af00-4033-11e9-9da6-f982b7d23569.png)


--- end body ---

comments :
--- start comments ---

--- end comments ---