There is Two Cross-Site Request Forgery (CSRF) vulnerabilities in ArticleCMS allow attackers to create users and escalate privileges.

[segonse]

There is Two Cross-Site Request Forgery (CSRF) vulnerabilities in ArticleCMS allow attackers to create users and escalate privileges.

When the super administrator (root) logged in, there are 2 important POST methods without CSRF protection, can create a new user and promote it to administrator privileges. This can be achieved by cheating the super administrator to open the 2 pages when he logged in.

Set up the cms on the public network server and log in to the root user to obtain a request package for creating a user.

burp intercepts the request and creates the csrf poc.

Create the csrf page locally

At this point in another browser, assuming that the root user logged in to the CMS and left a login information in a browser, and then click the send others CSRF link:
http://192.168.1.26/SAFE16/articlecms_csrf.html

Go to this page

View the user management page,The ‘hacker’ user is added successfully.

In this set of cms, the duties are divided into administrator, auditor and editor from top to bottom.Promotion requires the root user to click this button.

This is also a csrf attack similar to the operation of creating users above.

After two promotions, hacker is promoted to administrator.