-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from two key issues: 1) The user creation form lacked CSRF tokens (added via hidden token fields in templates), and 2) The validation rules didn't enforce token checks. The UserController::addPost method used a validation rule ('User') that didn't include CSRF protection, while UserValidate.php's ruleset for user_login lacked the 'token' rule. Together, this allowed CSRF attacks to create admin users. The patch added both the token field in templates and the token validation rule, confirming these were the missing protections.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| thinkcmf/thinkcmf | composer | < 6.0.8 | 6.0.8 |
PHPPHPKEV Misses 88% of Exploited CVEs- Get the report