Headline
CVE-2022-23888: YzmCMSV6. 3. There is a CSRF vulnerability in the foreground in the official version(YzmCMS V6.3 正式版前台存在csrf漏洞) · Issue #60 · yzmcms/yzmcms
YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgey (CSRF) via the component /yzmcms/comment/index/init.html.
Prepare two accounts: test01 and test02, background settings allow users to contribute,
Generate POC of CSRF with test01, First log in to test01 and comment on an article, and grab the request packet,
Log in to TEST02 with another browser and open the web page of the generated POC,
Triggered CSRF and successfully commented as TEST02.
