C.P.Sub before 5.3 allows CSRF via a manage.php?p=article_del&id= URI.
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Link | Tags |
---|---|
https://github.com/cooltey/C.P.Sub/issues/3 | third party advisory exploit |
https://github.com/cooltey/C.P.Sub/commit/b2be52fd89b6fd4d69d63d504bc11742cd679ebe | third party advisory patch |