CVE-2025-1745: Pb-cms CSRF Vulnerability in Logout

CVE-2025-1745 Overview

CVE-2025-1745 is a Cross-Site Request Forgery (CSRF) vulnerability in LinZhaoguan pb-cms version 2.0. The flaw resides in the Logout component of the content management system. An attacker can craft a malicious web page that, when visited by an authenticated user, forces the browser to submit a logout request without user consent. The exploit has been publicly disclosed, increasing the likelihood of opportunistic abuse against exposed installations.

The vulnerability is tracked under CWE-352: Cross-Site Request Forgery and is exploitable remotely over the network with user interaction.

Critical Impact
Attackers can force authenticated pb-cms users to execute unwanted logout actions through malicious links or embedded content, degrading availability of administrative sessions.

Affected Products

LinZhaoguan pb-cms 2.0
Component: Logout functionality
Deployments exposing the CMS to untrusted networks

Discovery Timeline

2025-02-27 - CVE-2025-1745 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1745

Vulnerability Analysis

The vulnerability affects an unspecified function within the Logout component of pb-cms 2.0. The logout endpoint accepts state-changing requests without validating a per-session anti-CSRF token. An attacker who lures an authenticated user to a controlled page can trigger a logout request that the browser transmits with the victim's active session cookies.

While the direct impact is limited to session termination, forced logout can be chained with phishing to redirect users to attacker-controlled login pages. This creates conditions for credential harvesting once the legitimate session ends.

The issue was assigned an EPSS probability of 0.26%, placing it in the 17th percentile for observed exploitation likelihood.

Root Cause

The root cause is the absence of a synchronizer token, SameSite cookie enforcement, or Origin/Referer header validation on the logout handler. Without any of these controls, the server cannot distinguish between a request originating from the legitimate pb-cms interface and one forged by a third-party site.

Attack Vector

Exploitation requires user interaction. An attacker hosts a page containing an auto-submitting form or an image tag pointing at the pb-cms logout URL. When an authenticated administrator or editor visits the page, the browser attaches the session cookie and issues the request. See the Gitee Issue Report for the disclosed proof-of-concept context.

No authentication or elevated privileges are required on the attacker side, and the attack can be initiated remotely across the network.

Detection Methods for CVE-2025-1745

Indicators of Compromise

Unexpected logout events for authenticated pb-cms users during active work sessions
HTTP requests to the pb-cms logout endpoint with Referer headers pointing to external, untrusted domains
Clustered logout events across multiple accounts within a short time window, suggesting a mass CSRF campaign

Detection Strategies

Inspect web server access logs for logout requests where the Referer header does not match the pb-cms origin
Correlate authentication logs with browser telemetry to identify logouts that were not user-initiated
Deploy web application firewall (WAF) rules that flag state-changing GET or POST requests missing a valid CSRF token parameter

Monitoring Recommendations

Enable verbose logging on the pb-cms authentication subsystem to capture session lifecycle events
Alert on repeated logout-followed-by-login sequences from the same source IP, which may indicate credential harvesting attempts
Monitor outbound proxy logs for users visiting URLs that reference the internal pb-cms domain from unexpected external pages

How to Mitigate CVE-2025-1745

Immediate Actions Required

Restrict access to pb-cms 2.0 administrative interfaces to trusted networks or VPN-only routes until a vendor fix is available
Configure session cookies with SameSite=Strict or SameSite=Lax attributes to block cross-site cookie transmission
Instruct administrators to log out and close browsers between sessions, and to avoid clicking untrusted links while authenticated

Patch Information

No official vendor patch is referenced in the CVE record at time of publication. Track the Gitee Issue Report and the VulDB entry #297832 for remediation updates from the maintainer.

Workarounds

Deploy a reverse proxy or WAF rule that requires a matching Origin or Referer header for requests to the logout endpoint
Add a custom middleware layer that injects and validates a per-session anti-CSRF token on all state-changing routes
Consider migrating away from pb-cms 2.0 to a maintained CMS platform if the vendor does not issue timely fixes

bash

# Example Nginx configuration to block cross-origin logout requests
location /logout {
    if ($http_referer !~* "^https?://your-pbcms-domain\.example") {
        return 403;
    }
    proxy_pass http://pbcms_backend;
}