Executive brief
Cotonti is a content management system used to build and manage websites. A security flaw in its administration panel allows an attacker to trick a logged-in administrator into unknowingly performing actions, such as granting the attacker full administrative rights. This could lead to a complete takeover of the website, theft of sensitive data, or the execution of malicious code on the server.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in Cotonti 1.0.0 (specifically commit f43f1fc3) within the 'system/admin/admin.rights.php' component. The rights update action ('a=update') fails to implement anti-CSRF token validation via the 'cot_check_xg()' function. By luring an authenticated administrator to a malicious website, a remote attacker can trigger a forged request to modify group access rights. Successful exploitation allows the attacker to elevate a controlled account to administrator status. Given that administrators can modify site templates and configurations, this vulnerability can be further leveraged to achieve Remote Code Execution (RCE).
Affected products
- Cotonti Cotonti 1.0.0 (commit f43f1fc3)
Timeline
- 2026-06-18: advisory: NVD publication date