Cross-Site Request Forgery in Windu CMS

An attacker can exploit this CSRF vulnerability by crafting a malicious website. When a logged-in Windu CMS user visits this website, a hidden POST request will be sent to the CMS, resulting in the deletion of the user's account. This could lead to denial of service for the affected user and potentially compromise the integrity of the CMS if the deleted user had administrative privileges. The blast radius is limited to users who are logged into the CMS and visit the malicious site, but the impact on individual users can be significant.

Administrators and users of Windu CMS installations running versions 0 through 4.1 are at risk. Shared hosting environments using Windu CMS are particularly vulnerable, as they may be more difficult to patch quickly. Users with administrative privileges are at higher risk due to the potential for account compromise.

• wordpress / composer / npm:

grep -r "/admin/user_edit.php" .  # Check for user edit page without CSRF tokens

• generic web:

curl -I https://your-windu-cms-site.com/admin/user_edit.php | grep -i 'csrf'

1. 2025-11-18Disclosure

   disclosure

1. Reserviert2025-09-09
2. Veröffentlicht2025-11-18
3. Geändert2025-12-05
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-59112 is to upgrade Windu CMS to version 4.1 build 2250 or later. If upgrading is not immediately feasible, consider implementing CSRF protection mechanisms such as adding CSRF tokens to all forms and sensitive endpoints. Web Application Firewalls (WAFs) can be configured to detect and block suspicious POST requests. After upgrading, confirm the vulnerability is resolved by attempting to delete a test user account via a crafted CSRF request.