-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability exists in plugin management endpoints (panel/modules/plugins/) where state-changing operations occur. Typical CMS architectures implement plugin activation/deactivation through controller actions that should require CSRF protection. The absence of CSRF tokens in these POST/PUT handlers would allow attackers to craft malicious requests that get executed when an authenticated admin visits a malicious page. While exact method names aren't confirmed, the pattern matches common Subrion CMS controller structures where action[Verb] methods handle operations without proper CSRF validation.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| intelliants/subrion | composer | <= 4.2.1 |