CVE-2015-20129

CrushFTP versions before 7.3.0 are vulnerable to a Cross-Site Request Forgery (CSRF) flaw due to disabled CSRF protection by default. An attacker can lure an authenticated administrator to a malicious page that automatically submits POST requests to the /WebInterface/function/ endpoint. This allo...