WS-2022-0292

It's possible to bypass the CSRF protection which is already implemented on the coreBOS CMS. When some request not contain any valid CSRF token, the webpage will be displayed an error. Looks like the csrf-magic.php / csrf-magic.js only checked the POST request and ignore the GET request.From this...