Cross-Site Request Forgery (CSRF) (CMS Made Simple)
Description
A Cross-Site Request Forgery (CSRF) vulnerability exists in CMS Made Simple versions prior to 2.1.6. The vulnerability allows attackers to craft malicious web pages or links that, when visited by an authenticated administrator, can execute unauthorized actions such as creating new administrative accounts without the administrator's knowledge or consent. This occurs because the admin/adduser.php endpoint does not properly validate that requests originate from legitimate user actions.
Remediation
Update CMS Made Simple to version 2.1.6 or later, which includes proper CSRF protection mechanisms. To remediate this vulnerability:
1. Immediately upgrade to CMS Made Simple version 2.1.6 or the latest stable release
2. Review administrator accounts for any unauthorized or suspicious entries created before the upgrade
3. Consider implementing additional security measures such as requiring administrators to use unique, hard-to-guess URLs for administrative access
4. Educate administrators about CSRF attacks and the importance of not clicking unknown links while logged into the CMS
If immediate patching is not possible, restrict administrative access to trusted IP addresses and ensure administrators only access the admin panel from secure, dedicated browsers or sessions.