CVE-2024-46485

Summary

CVE-2024-46485 is a newly disclosed vulnerability affecting the dingfanzu CMS version 1.0. This issue permits an attacker to conduct Cross-Site Request Forgery (CSRF) attacks through the /admin/doAdminAction.php?act=addCate endpoint. An attacker can trick an authenticated user into performing unintended actions on the administrator's dingfanzu CMS instance. Successful exploitation of this vulnerability could lead to the modification, deletion, or creation of content, putting the security and integrity of the affected website at risk. It is recommended that users immediately upgrade their dingfanzu CMS installation to a patched version to mitigate this threat.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.