Cross-Site Request Forgery in dingfanzu CMS Affects Administration Features
CVE-2024-48341

3.7LOW

Key Information:

Vendor

dingfanzu

Status
dingfanzu CMS
Vendor
CVE Published:
8 September 2025

What is CVE-2024-48341?

A security vulnerability has been identified in dingfanzu CMS version 1.0, which allows an attacker to perform unauthorized actions on behalf of an authenticated user. The issue arises from insufficient validation of requests to the /admin/doAdminAction.php endpoint, enabling potential exploitation via CSRF attacks. Attackers can craft a malicious request that, when executed by an authenticated user, may compromise sensitive administrative functionalities.

References

https://github.com/Jiingh/cms/tree/main/6/readme.md

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.