CVE-2021-47800: b2evolution CMS CSRF Vulnerability

CVE-2021-47800 Overview

CVE-2021-47800 is a Cross-Site Request Forgery (CSRF) vulnerability affecting b2evolution version 7.2.2, a popular open-source content management system and blogging platform. This vulnerability allows attackers to craft malicious HTML forms that, when loaded by an authenticated administrator, can submit unauthorized changes to user profiles and admin account details without any authentication tokens or validation.

The attack exploits the lack of anti-CSRF protections in the account modification functionality, enabling threat actors to trick victims into unknowingly executing administrative actions on the b2evolution platform.

Critical Impact

Attackers can modify admin account details including passwords, email addresses, and permissions without authentication, potentially leading to complete site takeover.

Affected Products

• b2evolution 7.2.2
• Earlier versions of b2evolution may also be affected

Discovery Timeline

• January 16, 2026 - CVE-2021-47800 published to NVD
• January 16, 2026 - Last updated in NVD database

Technical Details for CVE-2021-47800

Vulnerability Analysis

This Cross-Site Request Forgery vulnerability exists in b2evolution 7.2.2's user account management functionality. The application fails to implement proper CSRF token validation when processing requests to modify user profile details. As a result, the server cannot distinguish between legitimate user-initiated requests and forged requests submitted by an attacker.

The vulnerability is particularly concerning because it targets administrative functions. An attacker can construct a malicious webpage containing an auto-submitting HTML form that targets the vulnerable endpoint. When an authenticated administrator visits this page, their browser automatically submits the form with their session credentials, executing the unauthorized modifications.

The network-based attack vector requires user interaction, as the victim must be tricked into visiting the malicious page while logged into their b2evolution admin session. However, this can be accomplished through various social engineering techniques such as phishing emails, malicious advertisements, or compromised websites.

Root Cause

The root cause of CVE-2021-47800 is the absence of anti-CSRF tokens in the b2evolution account modification forms and the lack of server-side validation to verify the origin and authenticity of incoming requests. Without these protections, the application cannot verify that form submissions originate from legitimate user interactions within the application itself.

CWE-352 (Cross-Site Request Forgery) classifies this weakness, which occurs when a web application does not sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

Attack Vector

The attack leverages the network-based attack vector, requiring the attacker to host a malicious webpage or inject malicious content into a site the victim might visit. The attack proceeds as follows:

1. The attacker creates a malicious HTML page containing a hidden form that targets the b2evolution account modification endpoint
2. The form is populated with the attacker's desired changes (new email, password, or other profile details)
3. JavaScript on the malicious page automatically submits the form when loaded
4. When an authenticated b2evolution administrator visits the malicious page, their browser submits the request with their valid session cookies
5. The b2evolution server processes the request as legitimate, applying the unauthorized changes

The exploitation mechanism relies on crafting an HTML form that submits to the vulnerable b2evolution endpoint. When an authenticated administrator visits the attacker-controlled page, their browser automatically includes session credentials, causing the malicious modifications to be applied. Technical details and proof-of-concept information are available in the Exploit-DB #50081 advisory.

Detection Methods for CVE-2021-47800

Indicators of Compromise

• Unexpected modifications to administrator account details (email, password, permissions)
• User profile changes occurring from IP addresses that don't match normal admin access patterns
• Account modification requests lacking proper Referer headers or originating from external domains
• Multiple account changes occurring in rapid succession without corresponding login activity

Detection Strategies

• Monitor HTTP request logs for account modification requests with missing or invalid CSRF tokens
• Implement alerting for profile changes on privileged accounts, especially password or email modifications
• Analyze Referer headers on sensitive POST requests to identify potential cross-domain submissions
• Deploy web application firewalls (WAF) with CSRF detection rules to identify suspicious form submissions

Monitoring Recommendations

• Enable detailed logging for all administrative account modification actions in b2evolution
• Set up alerts for any changes to administrator email addresses or passwords
• Monitor for unusual patterns of account modifications, particularly those occurring without preceding authentication events
• Implement session anomaly detection to identify requests that may originate from forged submissions

How to Mitigate CVE-2021-47800

Immediate Actions Required

• Update b2evolution to the latest available version that includes CSRF protection patches
• Audit recent administrator account changes to identify any unauthorized modifications
• Reset credentials for all administrative accounts if compromise is suspected
• Implement network-level access controls to restrict administrative interface access

Patch Information

Users should update b2evolution to the latest version available from the official b2evolution downloads page. The b2evolution GitHub repository may contain additional information about security fixes and version history. Review the VulnCheck CSRF Advisory for detailed remediation guidance.

Workarounds

• Restrict access to the b2evolution administrative interface to trusted IP addresses only
• Implement a Web Application Firewall (WAF) with CSRF protection rules in front of the b2evolution installation
• Require multi-factor authentication for administrative account changes as an additional layer of protection
• Train administrators to avoid clicking links in emails or visiting untrusted websites while logged into the b2evolution admin panel

Administrators should configure web server access controls to limit administrative interface exposure. The following example restricts access to trusted IP addresses:

# Apache configuration to restrict admin access
<Directory "/path/to/b2evolution/admin">
    Require ip 192.168.1.0/24
    Require ip 10.0.0.0/8
</Directory>