Furykangaroo

The issue concerns a CSRF vulnerability in the admin interface, specifically affecting the "user/edit/1" endpoint. This could potentially allow unauthorized actions to be performed on user accounts.

The issue allows for CSRF attacks, enabling unauthorized actions such as creating a member, authenticating vip members, creating a super administrator, and creating a web editor through specific API endpoints: "upload/admin.php/user/save", "upload/admin.php/user/init/tid", and "upload/admin.php/user/init/rzid" and "upload/admin.php/sys/save".

The issue allows for Cross-Site Request Forgery (CSRF) attacks, which can be used to perform unauthorized actions on the application. Specifically, it affects the addition of pages via "admin.php?s=/Channel/add.html", the addition of blogs via "admin.php?s=/Article/update.html", and the setting of the audit state via "admin.php?s=/Article/setStatus/status/1.html".

The issue is related to reflected XSS, which can be triggered via the `p` parameter. This allows for potential malicious script injection.

An issue was discovered that allows a CSRF vulnerability, enabling an attacker to change the administrator's password via the "admin.php?mod=users" endpoint and subsequently add a page or menu, or submit a topic.

A CSRF issue allows adding administrators via the "upload/e/admin/user/AddUser.php?enews=AddUser" endpoint. This can be exploited to add new administrators without proper authorization.

An issue was discovered that allows modification of a website's basic configuration via a CSRF vulnerability. This can be exploited through the "upload/admin.php/setting/save" API endpoint.