MEDIUM4.3

GHSA-3qcm-pj6q-w4c5

Nodcms contains a cross-site request forgery vulnerability

Details

Nodcms contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious forms. Attackers can trick authenticated administrators into submitting requests to admin/user_manipulate and admin/settings/generall endpoints to create users or modify application settings without explicit consent.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/khodakhah/nodcms

Introduced in: 0

No fixed version published yet for khodakhah/nodcms (composer). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2016-20054[ADVISORY]
https://github.com/khodakhah/nodcms[PACKAGE]
https://www.exploit-db.com/exploits/40707[WEB]