CVE-2016-20054

1th percentile - higher than 1% of all known CVEs

Nodcms contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious forms. Attackers can trick authenticated administrators into submitting requests to admin/user_manipulate and admin/settings/generall endpoints to create users or modify application settings without explicit consent.

The risk is that an attacker can gain control over the application by adding a new administrator account or changing critical settings, leading to compromise of system integrity and confidentiality.

Implement CSRF protection mechanisms such as anti-CSRF tokens in forms and validation of the Origin or Referer header for sensitive administrative actions.