CVE-2020-20945

Name of the Vulnerable Software and Affected Versions: Qibosoft version 7

Description: A Cross-Site Request Forgery (CSRF) issue exists in the /admin/index.php?lfj=member&action=editmember endpoint of Qibosoft, allowing attackers to add administrator accounts arbitrarily.

Recommendations: For Qibosoft version 7, as a temporary workaround, consider restricting access to the /admin/index.php?lfj=member&action=editmember endpoint until a patch is available. Avoid using the action and lfj parameters in this endpoint until the issue is resolved.