Chenrui1896

The issue allows for CSRF via the "index.php?s=/admin/user/delAll" URI to delete users.

The issue allows for CSRF via the "index.php?m=Admin&c=Users&a=edit" API endpoint to add a user account. This is achieved by exploiting the lack of proper CSRF protection, allowing an attacker to perform unauthorized actions.

An issue was discovered that allows CSRF to add an admin account via the "/index.php?file=account&action=manageaccounts&job=newaccount" API endpoint.

An issue was discovered that allows CSRF to delete an article via an admincp deleteitem action to "index.php".