Executive brief
Cotonti, a content management system used for building websites, contains a security flaw that could allow an attacker to change site settings. By tricking a logged-in administrator into clicking a malicious link or visiting a compromised website, an attacker can remotely modify core system configurations. This could lead to a total takeover of the website, data theft, or the disabling of security features.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in Cotonti 1.0.0 (specifically master branch commit f43f1fc3) within the 'system/admin/admin.config.php' component. The configuration update action ('a=update') utilizes the cot_config_update_options() function to process POST data but fails to implement a call to cot_check_xg(), which is the application's standard mechanism for validating anti-CSRF tokens. An attacker can exploit this by inducing an authenticated administrator to submit a forged request. Successful exploitation allows the attacker to modify arbitrary core, module, or plugin configuration options, potentially leading to full site compromise or the weakening of other security controls.
Affected products
- Cotonti Cotonti 1.0.0 (master branch commit f43f1fc3)
Timeline
- 2026-06-18: advisory: NVD publication date