CVE-2020-25263
Description
PyroCMS 3.7 is vulnerable to cross-site request forgery (CSRF) via the admin/addons/uninstall/anomaly.module.blocks URI: an arbitrary plugin will be deleted.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
pyrocms/pyrocmsPackagist | <= 3.7 | — |
Affected products
2- PyroCMS/PyroCMSdescription
Patches
Vulnerability mechanics
Root cause
"Missing CSRF token validation on the plugin uninstall action, which is performed via a GET request."
Attack vector
An attacker hosts a malicious HTML page that sends a GET request to `/admin/addons/uninstall/anomaly.module.blocks` [ref_id=1]. Because PyroCMS does not verify whether the request was intentionally made by the authenticated user (CSRF), the browser automatically includes the victim's session cookies when the request is sent [CWE-352]. The attacker lures an already-authenticated PyroCMS admin to visit the malicious page via social engineering, and the plugin is deleted on the victim's behalf [ref_id=1].
Affected code
The advisory [ref_id=1] identifies the vulnerable URI as `/admin/addons/uninstall/anomaly.module.blocks`. The exact source file is not named in the bundle, but the vulnerability lies in the controller handling the uninstall action for addons/modules, which accepts a GET request without CSRF token validation.
What the fix does
No patch is included in the bundle. The advisory [ref_id=1] identifies that the root cause is the use of a GET request for a state-changing action (plugin uninstall) without CSRF protection. The remediation would require the application to either (a) require a CSRF token for the uninstall action, (b) change the HTTP method from GET to POST/DELETE, or (c) implement a confirmation step. The advisory does not specify whether a fix was ever released.
Preconditions
- authVictim must be authenticated to the PyroCMS admin panel
- inputAttacker must trick the victim into visiting a malicious page (social engineering)
- configThe target PyroCMS instance must be version 3.7
Reproduction
Create a page with the following content and host it on an attacker-controlled server. When an authenticated PyroCMS admin visits the page, the `anomaly.module.blocks` plugin will be deleted without their consent [ref_id=1].
```html <!DOCTYPE> <html> <head> <title></title> <script type="text/javascript"> var url = "http://test.com/admin/addons/uninstall/anomaly.module.blocks" xhr = new XMLHttpRequest(); xhr.open("GET",url); xhr.withCredentials = true; xhr.send(null); </script> </head> </html> ```
Generated on May 27, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
4- github.com/advisories/GHSA-vg2g-698h-v9w3ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2020-25263ghsaADVISORY
- gist.github.com/farid007/df51b0666643ec01d5571cbcc1e966e7ghsax_refsource_MISCWEB
- pyrocms.commitrex_refsource_MISC
News mentions
0No linked articles in our index yet.