CVE-2018-16387

Vulnerability

Elefant CMS versions prior to 2.0.5 contain a Cross-Site Request Forgery (CSRF) vulnerability in the /user/add endpoint. This allows an attacker to create a new administrator account without proper CSRF token validation [1][2].

Exploitation

An attacker can craft a malicious HTML page that, when visited by an authenticated administrator, automatically submits a form to /user/add with the attacker's desired account details (e.g., username, password, and admin role). The PoC shows a form with hidden inputs for all required fields, including a password and admin type [2]. No additional authentication or privileges are required beyond the victim's active session.

Impact

Successful exploitation allows the attacker to add a new administrator account, giving them full control over the CMS instance. This can lead to further compromise, including data theft, defacement, or server takeover [1][2].

Mitigation

The vulnerability is fixed in Elefant CMS version 2.0.5 [1]. Users should upgrade to this version or later. No workarounds have been provided for earlier versions.