Cross site request forgery (csrf)

BlackCat CMS 1.2 allows remote authenticated users to inject arbitrary PHP code into info.php via a crafted newmodulename parameter to backend/addons/ajaxcreate.php. NOTE: this can be exploited via CSRF...

PT-2017-13222

Name of the Vulnerable Software and Affected Versions BlackCat CMS version 1.2 Description The issue allows remote authenticated users to inject arbitrary PHP code into info.php via a crafted new modulename parameter to the "backend/addons/ajax create.php" endpoint. This can be exploited via CSRF...