CVE-2018-18449

Name of the Vulnerable Software and Affected Versions EmpireCMS version 7.5

Description The issue allows for CSRF, enabling the addition of a user account through an action to e/admin/user/ListUser.php. This is achieved by utilizing the enews=AddUser action.

Recommendations For EmpireCMS version 7.5, consider implementing CSRF protection measures to prevent unauthorized additions of user accounts. As a temporary workaround, restrict access to the e/admin/user/ListUser.php endpoint to minimize the risk of exploitation.