CVE-2015-1424

Name of the Vulnerable Software and Affected Versions Gecko CMS versions 2.2 through 2.3

Description A cross-site request forgery issue allows remote attackers to hijack administrator authentication for requests that add a new administrator user via a newuser request to "admin/index.php".

Recommendations For Gecko CMS version 2.2, update to a version that fixes this issue. For Gecko CMS version 2.3, update to a version that fixes this issue. As a temporary workaround, consider restricting access to the "admin/index.php" endpoint to minimize the risk of exploitation.