CVE-2020-37241

### Vulnerability bloofoxCMS 0.5.2.1 suffers from a cross-site request forgery (CSRF) vulnerability in the admin user creation functionality [1][2]. The application fails to perform any validity checks on HTTP requests to the user-facing endpoints, such as generating unique tokens. As a result, an attacker can craft a hidden form that submits a POST request to admin/index.php?mode=user&action=new&submit=send with arbitrary username, password, and role parameters without any session-specific nonce or origin verification [2].

Exploitation

An attacker can host a malicious HTML page containing an auto-submitting form that targets the vulnerable admin endpoint. When a logged-in administrator visits this page (e.g., via a phishing link or embedded in another site), the form silently transmits the forged request using the victim's active session [2]. No explicit user interaction is required beyond navigation to the crafted page; the PoC provided by security researchers uses window.onload to trigger the submission automatically, requiring only that the administrator is authenticated [2]. The attack requires no additional privileges or user interface actions.

Impact

Successful exploitation allows an attacker to create a new administrative account with arbitrary credentials (username, password, and admin role) [2]. This effectively grants the attacker full control over the CMS, enabling them to modify content, change configuration, or escalate further attacks against the application or its users. The CSRF vulnerability is present in versions up to and including 0.5.2.1 [4].

### Mitigation bloofoxCMS 0.5.2.1 is the mentioned fix version. The reference suggests it has been addressed in this release, but no descriptive changelog or explicit CSRF fix is confirmed in the notes [1]. The vendor homepage lists 0.5.2.1 as the latest version but does not detail the vulnerability [3]. Users should upgrade to 0.5.2.1 if they are running an earlier version, apply web application firewall rules to validate origin headers, or enforce a CSRF token mechanism in custom code until an official patch is confirmed.