CVE-2013-20005: Qool CMS 2.0 RC2 CSRF Vulnerability

CVE-2013-20005 Overview

Qool CMS 2.0 RC2 contains a cross-site request forgery (CSRF) vulnerability that allows attackers to perform administrative actions by tricking logged-in users into visiting malicious web pages. Attackers can forge POST requests to the /admin/adduser endpoint with parameters like username, password, email, and level to create root-level user accounts without user consent.

Critical Impact

Successful exploitation enables attackers to create administrative user accounts on the Qool CMS system, leading to complete application takeover without any direct authentication.

Affected Products

• Qool CMS 2.0 RC2

Discovery Timeline

• 2026-03-16 - CVE CVE-2013-20005 published to NVD
• 2026-03-16 - Last updated in NVD database

Technical Details for CVE-2013-20005

Vulnerability Analysis

This Cross-Site Request Forgery (CSRF) vulnerability exists in Qool CMS 2.0 RC2 due to the absence of proper anti-CSRF token validation on the administrative user creation endpoint. When an authenticated administrator visits a malicious webpage containing a crafted form or JavaScript, the attacker can silently submit a request to /admin/adduser that creates a new administrative account.

The vulnerability is classified under CWE-79, though the attack mechanism is a classic CSRF pattern where the application fails to verify that form submissions originate from legitimate user interactions within the application itself. The administrative interface does not implement CSRF protection mechanisms such as synchronizer tokens, double-submit cookies, or origin header validation.

Root Cause

The root cause of this vulnerability is the lack of CSRF token validation in the Qool CMS administrative interface. The /admin/adduser endpoint processes POST requests and creates user accounts based solely on session authentication, without verifying that the request originated from a legitimate form submission within the application.

Attack Vector

The attack vector is network-based and requires no authentication from the attacker's perspective. An attacker crafts a malicious HTML page containing a hidden form or JavaScript that automatically submits a POST request to the victim's Qool CMS installation. The request targets the /admin/adduser endpoint with attacker-controlled parameters including username, password, email, and level (set to root/admin level). When an authenticated administrator visits the malicious page, their browser automatically includes their session cookies with the forged request, causing the CMS to create the attacker's account with full administrative privileges.

The vulnerability is documented in technical advisories from Zero Science Labs and Exploit-DB #24627, which provide detailed technical analysis of the attack mechanism.

Detection Methods for CVE-2013-20005

Indicators of Compromise

• Unexpected administrative user accounts appearing in the Qool CMS user database
• Web server logs showing POST requests to /admin/adduser with unusual referrer headers from external domains
• User account creation events occurring without corresponding legitimate administrative sessions

Detection Strategies

• Monitor web application logs for POST requests to /admin/adduser with external or missing Referer headers
• Implement alerting on new administrative account creation events
• Review access logs for patterns indicating CSRF attacks, such as rapid user creation from different source IPs

Monitoring Recommendations

• Enable detailed logging of all administrative actions within Qool CMS
• Configure web application firewall (WAF) rules to detect and block suspicious cross-origin form submissions
• Implement regular audits of administrative user accounts to identify unauthorized additions

How to Mitigate CVE-2013-20005

Immediate Actions Required

• Discontinue use of Qool CMS 2.0 RC2 in production environments if possible
• Implement web application firewall rules to validate Referer and Origin headers for administrative endpoints
• Restrict administrative interface access to trusted IP addresses or networks
• Regularly audit administrative user accounts for unauthorized entries

Patch Information

No official vendor patch information is available for this vulnerability. The VulnCheck Advisory provides additional context on the vulnerability status. Organizations using Qool CMS should consider migrating to an actively maintained CMS platform.

Workarounds

• Add custom CSRF token validation to the /admin/adduser endpoint through application modification or WAF rules
• Implement strict Content Security Policy (CSP) headers to prevent unauthorized form submissions
• Use browser-level protections by requiring administrators to use SameSite cookie attributes
• Restrict administrative panel access to VPN-only or internal network segments

# Example: Apache mod_security rule to validate Referer header for admin endpoints
SecRule REQUEST_URI "@contains /admin/adduser" \
    "id:100001,phase:2,deny,status:403,\
    chain"
SecRule REQUEST_HEADERS:Referer "!@contains yourdomain.com" \
    "t:none"