Description

I found one more CSRF at Clean cache in theSystemtab ofSystem configuration via GET request.

Proof of Concept

<a href="https://demo.livehelperchat.com/site_admin/system/expirecache">CLICK ME!</a>

Impact

This vulnerability is capable of tricking admin to clear the cache of the system, that can potential lead to a DoS attack.

Remediation

Use POST request combined with a CSRF token instead of using GET request.