Fixing CSRF in QACMS in general may produce several problem as QACMS heavily relies on AJAX and dynamic forms building. We could try to secure certain sections of the CMS, such as content/user editing forms, etc.
@ChristopherCastro do you plan to address this? note that a CVE was assigned to this issue.
If you disagree with the assignment you may contact MITRE directly to reject the CVE.
Hello. I'd like to report a security issue on the admin page.
Summary
this vuln is CSRF vuln that allows creating any kinds of account.
When an attacker induces authorized victims to a malicious webpage and make them send requests. a victim creates an account without their intent.
Reproduce
This is a step how to reproduce.
Then you find an admin account named [test] is created.
Payloads
I think this security issue is not serious. Because attack using this vulnerability requires induction.
Event