Wuzhi · Wuzhi Cms · CVE-2018-10312
Name of the Vulnerable Software and Affected Versions:
WUZHI CMS version 4.1.0
Description:
The issue allows for a CSRF attack to change the password of a common member. This is possible through the "index.php?m=member&v=pw reset" endpoint, which is vulnerable to such attacks.
Recommendations:
For WUZHI CMS version 4.1.0, consider implementing CSRF protection measures, such as token-based validation, to prevent unauthorized password changes. As a temporary workaround, restrict access to the "index.php?m=member&v=pw reset" endpoint to minimize the risk of exploitation.