CVE-2020-25262
Description
PyroCMS 3.7 is vulnerable to cross-site request forgery (CSRF) via the admin/pages/delete/ URI: pages will be deleted.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
pyrocms/pyrocmsPackagist | <= 3.7 | — |
Affected products
2- PyroCMS/PyroCMSdescription
Patches
Vulnerability mechanics
Root cause
"The delete action is performed via a GET request with no CSRF token validation, allowing an attacker to forge requests that delete pages on behalf of an authenticated victim."
Attack vector
An attacker hosts a malicious HTML page containing JavaScript that sends GET requests to the PyroCMS admin/pages/delete/ URI [ref_id=1]. When an authenticated administrator visits the attacker's page, the script iterates through page IDs (e.g., 1 through 13) and issues XMLHttpRequest calls to delete each page [ref_id=1]. Because the delete action uses a GET request and lacks CSRF protection [CWE-352], the browser automatically includes the victim's session cookies, and the server processes the forged requests as legitimate.
Affected code
The advisory [ref_id=1] identifies the vulnerable endpoint as the admin/pages/delete/ URI. The researcher's PoC demonstrates that the delete action is triggered via a GET request to URLs of the form http://test.com/admin/pages/delete/{id}. No specific source file or function is named in the bundle.
What the fix does
No patch is published in the bundle. The advisory [ref_id=1] identifies the root cause as the delete action being performed via a GET request without CSRF tokens. The remediation would require the application to enforce CSRF tokens on state-changing operations (such as page deletion) and to use POST/DELETE HTTP methods instead of GET for destructive actions, so that an attacker's cross-origin form or script cannot forge valid requests.
Preconditions
- authThe victim must be authenticated to the PyroCMS application with a valid session.
- inputThe victim must visit a malicious page controlled by the attacker (e.g., via social engineering).
- inputThe attacker must know or guess valid page IDs to delete (the PoC uses IDs 1 through 13).
Reproduction
1. Create an HTML file with the following content (adjust the base URL to match the target PyroCMS instance): ```html <!DOCTYPE html> <html> <head> <title></title> <script type="text/javascript"> var url = "http://test.com/admin/pages/delete/" for (var i = 1; i <= 13 ; i++) { var url1 = url+i; xhr = new XMLHttpRequest(); xhr.open('GET', url1, true); xhr.send(); } </script> </head> <body></body> </html> ``` 2. Host the file on an attacker-controlled server. 3. Send the link to an authenticated PyroCMS administrator. 4. When the victim visits the page, pages with IDs 1 through 13 are deleted without their knowledge or consent [ref_id=1].
Generated on May 27, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
4- github.com/advisories/GHSA-56xx-pv88-2662ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2020-25262ghsaADVISORY
- gist.github.com/farid007/2af454d909fa5a60a07e4e547e99964eghsax_refsource_MISCWEB
- pyrocms.commitrex_refsource_MISC
News mentions
0No linked articles in our index yet.