CVE-2020-19951
📋 TL;DR
This CSRF vulnerability in YzmCMS v5.5 allows attackers to trick authenticated users into performing unintended actions by submitting malicious requests. Attackers could potentially modify payment settings or access sensitive administrative functions. All users running YzmCMS v5.5 are affected.
💻 Affected Systems
- YzmCMS
📦 What is this software?
Yzmcms by Yzmcms
⚠️ Risk & Real-World Impact
Worst Case
Attackers could modify payment configurations, redirect funds, or gain administrative access to the CMS, potentially leading to financial loss or complete system compromise.
Likely Case
Attackers could modify payment settings or perform unauthorized administrative actions through tricked authenticated users.
If Mitigated
With proper CSRF protections, the vulnerability would be blocked, preventing unauthorized actions even if malicious requests are sent.
🎯 Exploit Status
Exploitation requires tricking an authenticated user into visiting a malicious page or clicking a malicious link.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v5.6 or later
Vendor Advisory: https://github.com/yzmcms/yzmcms/issues/43
Restart Required: No
Instructions:
1. Upgrade YzmCMS to version 5.6 or later. 2. Replace the affected /controller/pay.class.php file with the patched version. 3. Verify CSRF tokens are properly implemented in payment forms.
🔧 Temporary Workarounds
Implement CSRF Protection
allAdd CSRF tokens to all payment-related forms and validate them server-side.
Edit /controller/pay.class.php to include CSRF token validation
Restrict Payment Controller Access
allImplement additional authentication checks or IP restrictions for payment-related endpoints.
Add authentication middleware to payment controller routes
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to detect and block CSRF attacks
- Educate users about phishing risks and implement strict access controls for payment functions
🔍 How to Verify
Check if Vulnerable:
Check if running YzmCMS v5.5 and examine /controller/pay.class.php for missing CSRF token validation.Check Version:
Check YzmCMS configuration files or admin panel for version informationVerify Fix Applied:
Verify the YzmCMS version is 5.6 or later and test payment forms for proper CSRF token implementation.📡 Detection & Monitoring
Log Indicators:
- Multiple failed payment requests from same IP
- Unusual payment configuration changes
Network Indicators:
- Requests to payment endpoints without proper referrer headers
- Suspicious cross-origin requests
SIEM Query:
source="web_logs" AND (uri="/controller/pay.class.php" AND NOT csrf_token_valid="true")