Chemcms · Chemcms · CVE-2018-10295
Name of the Vulnerable Software and Affected Versions:
ChemCMS version 1.0.6
Description:
The issue allows for CSRF by utilizing the "public/admin/user/addpost.html" endpoint to add an administrator account.
Recommendations:
For ChemCMS version 1.0.6, consider implementing proper CSRF protection mechanisms to prevent unauthorized actions, such as adding administrator accounts through the "public/admin/user/addpost.html" endpoint. As a temporary workaround, restrict access to this endpoint until a proper fix is applied.