Headline
CVE-2022-23887: YzmCMS V6. 3. CSRF vulnerability exists in the official version(YzmCMS V6.3 正式版存在csrf漏洞) · Issue #59 · yzmcms/yzmcms
YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily delete user accounts via /admin/admin_manage/delete.
This vulnerability allows arbitrary users to be deleted,
There is a user with ID 3,
Click delete and capture the package to generate the POC of CSRF,
Package the deletion request to dorp, and put the generated POC in the HTML page and send it to the administrator. When the administrator clicks the page, the user with ID 3 can be deleted.
