Cross site request forgery (csrf)

An issue was discovered in DamiCMS 6.0.0. There is an CSRF vulnerability that can revise the administrator account's password via /admin.php?s=/Admin/doedit...

CVE-2018-15844

DamiCMS 6.0.0 is affected by a Cross-Site Request Forgery vulnerability that can change the administrator password via /admin.php?s=/Admin/doedit. Root cause identified as CSRF in the admin password edit flow; PoC and public writeups exist (e.g., Exploit-DB record for 6.0.0 CSRF). The vulnerabili...

PT-2018-13233

Name of the Vulnerable Software and Affected Versions DamiCMS version 6.0.0 Description An issue was discovered that allows revision of the administrator account's password via the "API Endpoint: /admin.php?s=/Admin/doedit" due to a CSRF vulnerability. Recommendations For DamiCMS version 6.0.0,...