Tribq CMS 5.2.7 CSRF modify and add administrator accounts

# Title: Tribq cms csrf-Adding/Editing new administrator account # discoverer: Yashar shahinzadeh # developer: http://sourceforge.net/projects/tribiq/# Test Platform: Linux & Windows, PHP 5.2.9 # affected versions: 5.2.7 Abstract: ========== 1. CSRF-Adding administrator account 1. CSRF-Adding administrator account: ====================================================== From my standpoint, tribq is a good CMS which is immune to well-known vulnerabilities aside from CSRF. there are too includevastating actions may be done by hacker by conducting CSRF attack, although the critical ones are changing administrator password or adding new one. I provide an example of adding new administrator account, the attack can be done easily, afterwards, such a plain text may be appeared: {"adminId": 20, "adminType ": "local"}