S Cms · S-Cms · CVE-2018-19332
**Name of the Vulnerable Software and Affected Versions**
S-CMS version 1.5
**Description**
A CSRF issue allows adding a new user via the "admin/ajax.php?type=member&action=add" API endpoint.
**Recommendations**
For S-CMS version 1.5, consider implementing proper CSRF protection mechanisms to prevent unauthorized actions, such as adding new users, until a patch is available. As a temporary workaround, restrict access to the "admin/ajax.php" endpoint to minimize the risk of exploitation.